Paper deep dive
Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability
Yudong Gao, Linghan Chen, Wenhan Wu, Mia Zhou, Jiyao Wang, Kaiyan Ji, Mingyu Guo, Honglong Chen
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 8/22/2026, 2:22:51 AM
Summary
This paper introduces the first bit-flip attack (BFA) on Quantized Vision-Language-Action (VLA) models, demonstrating that gradient-selected INT8 weight flips can collapse closed-loop robot task success to 0%. The study compares three action-decoding architectures: direct regression, discrete token policies, and flow-matching policies. It finds that damaging bits concentrate in specific action-generating layers, with attack budgets varying sharply by architecture (1-5 flips for direct/token heads vs. 100-300 for flow heads). The authors propose a fixed-direction manifold-escape loss to optimize flip selection, significantly reducing the required budget for flow-matching models. Defensive strategies involving selective weight protection are also evaluated, showing that protecting a small percentage of weights can preserve success rates.
Entities (11)
Relation Signals (7)
Bit-Flip Attack → targets → Vision-Language-Action Models
confidence 98% · We present the first bit-flip attack on a VLA: a few gradient-selected flips reduce closed-loop success to 0%
Bit-Flip Attack → reducessuccessrateto → 0
confidence 95% · a few gradient-selected flips reduce closed-loop success to 0%
Manifold-Escape Loss → reducesbudgetfor → π 0
confidence 92% · Our fixed-direction manifold-escape loss cuts π0's budget from ~1000 to ~100 flips
Direct Regression Head → requires → 1-5 flips
confidence 90% · direct regression and token policies fall in 1--5 flips
Flow-Matching Policy → requires → 100-300 flips
confidence 90% · whereas the evaluated flow-matching policies require ~100–300.
Rowhammer → causes → INT8 corruption
confidence 85% · Rowhammer-style faults can corrupt deployed INT8 bits.
Weight Protection → preservessuccessat → K=100
confidence 85% · protecting 3.1% of weights preserves 60% success at K=100
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Quantized Vision-Language-Action (VLA) models expose a weight-fault surface: Rowhammer-style faults can corrupt deployed INT8 bits. We present the first bit-flip attack on a VLA: a few gradient-selected flips reduce closed-loop success to $0\%$, while hundreds of random flips are harmless. Across four model variants spanning three action-head families, damaging bits concentrate in a few action-generating layers, but the empirical budget depends sharply on the head: direct regression and token policies fall in $1$--$5$ flips, whereas the evaluated flow-matching policies require ${\sim}100$--$300$. Our fixed-direction manifold-escape loss cuts \pizero{}'s budget from ${\sim}1000$ to ${\sim}100$ flips, and a matched five-direction sweep shows that the attack is not specific to an all-positive direction. On a direct head, protecting $3.1\%$ of weights preserves $60\%$ success at $K{=}100$, and protecting $5.3\%$ moves the open-loop break threshold from 3 to 100 flips. Finally, task-calibrated emulated $K{=}100$ flips yield $0/20$ real-robot successes, versus $14/20$ clean and $16/20$ global-random. Weight integrity is therefore a security boundary for embodied foundation models. Code is included as ancillary material.
Tags
Links
- Source: https://arxiv.org/abs/2608.15475v1
- Canonical: https://arxiv.org/abs/2608.15475v1
Trouble viewing inline? Open PDF directly →
Full Text
50,033 characters extracted from source content.
Expand or collapse full text
Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability Yudong Gao Linghan Chen Wenhan Wu Mia Zhou Jiyao Wang Kaiyan Ji Mingyu Guo Honglong Chen Abstract Quantized Vision-Language-Action (VLA) models expose a weight-fault surface: Rowhammer-style faults can corrupt deployed INT8 bits. We present the first bit-flip attack on a VLA: a few gradient-selected flips reduce closed-loop success to 0%0\%, while hundreds of random flips are harmless. Across four model variants spanning three action-head families, damaging bits concentrate in a few action-generating layers, but the empirical budget depends sharply on the head: direct regression and token policies fall in 11–55 flips, whereas the evaluated flow-matching policies require ∼100 100–300300. Our fixed-direction manifold-escape loss cuts π0 _0’s budget from ∼1000 1000 to ∼100 100 flips, and a matched five-direction sweep shows that the attack is not specific to an all-positive direction. On a direct head, protecting 3.1%3.1\% of weights preserves 60%60\% success at K=100K=100, and protecting 5.3%5.3\% moves the open-loop break threshold from 3 to 100 flips. Finally, task-calibrated emulated K=100K=100 flips yield 0/200/20 real-robot successes, versus 14/2014/20 clean and 16/2016/20 global-random. Weight integrity is therefore a security boundary for embodied foundation models. Code is included as ancillary material. 1 Introduction Vision-Language-Action (VLA) models such as OpenVLA (Kim et al. 2024), π0 _0 (Black et al. 2024), and RT-2 (Zitkovich et al. 2023) map images and instructions directly to robot actions. Existing attacks target inputs or training-time backdoors (Gao et al. 2024a), leaving deployed weights intact. Yet low-precision edge deployment (Kim et al. 2024) makes integer weights a target for Rowhammer-style faults. A few flips have crushed quantized classifiers (Rakin et al. 2019; Yao et al. 2020) and, more recently, LLMs (Khalil and Hoque 2025; Galil et al. 2026), but only at categorical outputs. A classifier fault is read out once; a VLA fault passes through an action decoder and then repeatedly interacts with a changing environment. Decoder dynamics may attenuate the immediate perturbation, while modest residual errors can compound through feedback. Classifier BFA budgets and open-loop deviations therefore do not predict closed-loop robot failure. We ask: how few weight flips cause such failure, and how can they be contained? Figure 1: Fixed-direction insight. Across ten rerankings it is never less coherent than energy (7 higher, 3 ties) and lowers π0 _0’s empirical collapse budget 10×10×. On LIBERO-Spatial, 3 selected flips collapse simulated closed-loop success from 88% to 0% (n=50n=50); 11–55 flips suffice across four suites, while 300 random flips are harmless (Table 1). The evaluated flow heads instead require ∼100 100–300300 flips. On a real 6-DoF arm, task-calibrated emulated K=100K=100 perturbations yield 0/200/20 successes, versus 14/2014/20 clean and 16/2016/20 global-random (§6.2). Figure 1 motivates our flow-head objective: across ten independent K=100K=100 rerankings, fixed direction is never less coherent than energy (seven higher, three ties; one-sided Wilcoxon p=.0078p=.0078) and its same-policy empirical collapse budget is 10×10× lower. We therefore optimize the same nonzero, one-sided executed-action projection on every calibration trace, seeking perturbations with a common action-space orientation. Backpropagating this objective through the complete decoder scores each INT8 bit by its quantization-aware directional gain. The complementary where insight is spatial: damaging bits concentrate in a few action-generating layers (Fig. 5). Together, these observations guide both attack and defense. Gradient ranking discovers high-leverage layers, and a matched sweep confirms that fixed-direction manifold escape is not peculiar to the all-positive default (§6.5). Conversely, protecting L1 (3.1%3.1\%) preserves closed-loop success through K=100K=100; adding the action head (5.3%5.3\% total) moves the open-loop threshold from 3 to 100. Contributions. (1) The first weight-fault attack on a VLA. To our knowledge, this is the first bit-flip attack on a VLA and a continuous, closed-loop action policy. Just 11–55 selected INT8 flips collapse simulated task success to 0%0\%, revealing closed-loop consequences absent from prior attacks on categorical outputs. (2) An empirical vulnerability spectrum and an architecture-aware attack. Across direct-regression, discrete-token, and flow-matching decoders, we localize damaging bits to high-leverage action layers. Fixed-direction manifold escape breaks the evaluated flow heads with ∼10× 10× fewer flips than isotropic energy, and a matched five-direction sweep rejects an all-positive-direction artifact. (3) Broad evaluation and localized protection. Across five simulation checkpoints, four LIBERO suites, and SimplerEnv, attack budgets range from 11–55 flips for direct heads to ∼100 100–300300 for flow heads. A separate real-trained π0.5 _0.5 with task-calibrated emulated K=100K=100 perturbations yields 0/200/20 real-robot successes. On a direct head, 3.1%3.1\% protection preserves 60%60\% success at K=100K=100, and 5.3%5.3\% protection raises the open-loop threshold 33×33×. 2 Related Work Security of VLAs and generative robot policies. AttackVLA and ANNIE study input-side VLA attacks (Li et al. 2025; Huang et al. 2025); BadVLA, TrojanRobot, and DropVLA study training- or supply-chain backdoors, including action-level backdoors (Zhou et al. 2025; Wang et al. 2024; Xu et al. 2025). For diffusion and flow policies (Chi et al. 2025; Lipman et al. 2023), DP-Attacker perturbs inputs and identifies the visual encoder as vulnerable (Chen et al. 2024), while TrojFlow implants triggers (Qi and Xu 2024). Broader image-security work studies stealthy backdoors, retraining-free backdoor removal, and black-box reconstruction defenses (Gao et al. 2024a; Gao et al. 2024b; Yu et al. 2025). We instead corrupt served weights: damage concentrates in the action expert, and the evaluated flow heads require larger directed budgets (§6.4–6.5). Bit flips and quantized deployment. BFA/PBS gradient-ranks INT8 bits, collapsing classifiers with ∼11 11–1717 flips while hundreds of random flips do little (Rakin et al. 2019); targeted variants install chosen behavior (Rakin et al. 2022). Recent work scales search to LLMs (Khalil and Hoque 2025), finds sparse sign-bit lesions that motivate selective protection (Galil et al. 2026), and reports block-localized BFA sensitivity in vision transformers (Zhou et al. 2024). DeepHammer realizes DDR3/4 faults (Yao et al. 2020), while GPUHammer and GDDRHammer extend Rowhammer to GPU memory (Lin et al. 2025; Hu et al. 2026). Defenses include binarization, clipping, and selective checksums/ECC (Rakin et al. 2021; He et al. 2020; Li et al. 2021; Chen et al. 2025). VLA quantization studies efficiency (Wang et al. 2025; Zhang et al. 2026; Akbari et al. 2026), while quantization-conditioned backdoors poison weights before release (Hong et al. 2021); neither addresses served-weight faults in continuous closed-loop action. 3 Preliminaries Quantized VLA policies. A VLA policy πθ:→ _θ:O\!→\!A maps o=(image,instruction)o=(image,instruction) to an H-step, d-dimensional action chunk aθ(o)a_θ(o). Its action-generating transformer has weights θ=W(ℓ)ℓθ=\W^( )\_ . We evaluate three decoders: a direct-regression head, aθ=Wohθ(o)+boa_θ=W_oh_θ(o)+b_o; a discrete-token head with C=256C=256 bins, ah,r=decode(argmaxczh,r,c(o))a_h,r=decode( _cz_h,r,c(o)); and a flow-matching head that transforms x1∼(0,I)x_1 (0,I) into a=x0a=x_0: aθ(o,x1) a_θ(o,x_1) =x1+∫10vθ(xt,t,co)t =x_1+ _1^0v_θ(x_t,t,c_o)\,dt (1) ≈x1+∑k=1NΔtvθ(xtk,tk,co),Δt=−1/N. ≈ x_1+ _k=1^N t\,v_θ(x_t_k,t_k,c_o), t=-1/N. The final flow action therefore depends on a sequence of solver updates rather than a single readout. INT8 logical faults. Every eligible linear weight is quantized per output channel; stored integers are faultable, while scales and activations remain intact. Definition 1 (Per-channel symmetric INT8 quantization). For W∈ℝm×nW ^m× n, let si=maxmaxj|Wij|/127,10−8s_i= \ _j|W_ij|/127,10^-8\ and qij=clip[−128,127](round(Wij/si))q_ij=clip_[-128,127](round(W_ij/s_i)). The stored qijq_ij uses 8-bit two’s-complement representation, and inference dequantizes W^ij=qijsi W_ij=q_ijs_i. An all-zero row maps to qij=0q_ij=0. For the OFT policy, clean quantization changes the action by only ‖aθ^(o)−aθ(o)‖=0.003\|a_ θ(o)-a_θ(o)\|=0.003, well below its action scale. Definition 2 (Bit flip and induced weight perturbation). Toggling b∈0,…,7b∈\0,…,7\ maps qij↦flipb(qij)q_ij _b(q_ij) and changes the dequantized weight by Δijb=(flipb(qij)−qij)si _ijb=(flip_b(q_ij)-q_ij)s_i. Non-sign and sign flips change the integer by at most 6464 and 128128, respectively, so |Δijb|≤128si| _ijb|≤ 128s_i and no INT8 flip directly produces ∞/NaN. Decoder-dependent propagation is therefore meaningful for these bounded faults. 4 Threat Model Deployment and attacker. We consider an edge-served INT8 VLA whose model memory may be shared with an untrusted process. Following BFA (Rakin et al. 2019), the attacker knows the architecture, stored weights, scales, and decoder, and has a small calibration set calD_cal disjoint from evaluation. It induces at most K persistent linear-weight flips, one per selected scalar, but controls neither training, inputs, activations, scales, nor the environment. The baseline deployment lacks effective end-to-end memory integrity or ECC. Goal and defender. The primary goal is to collapse closed-loop success with few flips; targeted diagnostics instead drive a chosen action. Selective protection removes defended weights from the candidate set and rebuilds the attack over the remainder, making defense evaluation adaptive rather than a replay. Figure 2: Fixed-direction manifold-escape attack. The displayed L=−a⋅uL=-a· u is gradient-equivalent to the centered loss in Eq. (3). A bit score s=gΔs=g predicts its first-order loss change; ranking uses the corresponding gain G=−sG=-s and discovers high-leverage layers without an architectural prior. Physical-delivery boundary. DeepHammer maps profiled cells and induces targeted chains (Yao et al. 2020); GPUHammer reports 8 flips across four GDDR6 banks, while GDDRHammer demonstrates cross-component attacks (Lin et al. 2025; Hu et al. 2026). Prior demonstrations reach fault counts comparable to our 11–55 direct-head regime, but coordinate reachability remains device-, placement-, and fault-profile-dependent. We therefore evaluate logical INT8 corruption rather than end-to-end physical delivery; the ∼100 100–300300 flow-head regime is not a deliverability claim. 5 Method Our evidence points to two factors—how faults propagate through the decoder and where high-leverage weights lie—which become two design choices: an executed-action objective that remains effective through iterative decoding, and an unrestricted quantization-aware ranking that reveals sensitive locations. Step 1 specifies how the executed action should move, while Step 2 determines where that displacement can be induced most efficiently. The objective is decoder-aware; the location search remains architecture-agnostic. For (weight,bit)(weight,bit) pairs ℱF, define δθ(ℱ) δθ(F) =∑((ℓ,i,j),b)∈ℱΔijb(ℓ)eij(ℓ), = _(( ,i,j),b) ^( )_ijbe^( )_ij, (2) ℱ⋆ ∈argmin|ℱ|≤KL(θ^+δθ(ℱ),θ^), ∈ _|F|≤ KL ( θ+δθ(F); θ ), where eij(ℓ)e^( )_ij is the unit weight-coordinate and the clean-reference argument is omitted when unnecessary. For NwN_w eligible scalar weights, exact optimization over ∼8Nw 8N_w bit candidates is intractable, so we use two steps (Fig. 2). Step 1: design the loss (§5.1). We differentiate the final executed action for every decoder and construct a fixed-direction manifold-escape loss that remains effective through flow sampling. Step 2: rank and flip (§5.2). Following gradient-ranked bit search (Rakin et al. 2019), we combine the action gradient with each exact dequantized bit change. All action-generating linears remain eligible, so localization is an outcome rather than a prior. Algorithm 1 gives the procedure. 5.1 Step 1: a fixed-direction manifold-escape loss Differentiable executed actions. We construct an attack-time differentiable action a~θ a_θ for each decoder. Direct regression uses a~θ=aθ a_θ=a_θ. For discrete tokens, only the ranking gradient replaces argmax with the expected decoded value a~h,r=∑csoftmax(zh,r)cνc a_h,r= _csoftmax(z_h,r)_c _c, where νc _c denotes bin c; evaluation retains the hard decoder. A flow policy uses a~θ=aθ=x0 a_θ=a_θ=x_0, backpropagated through all solver steps in Eq. (1). Because the attack targets executed action rather than field fit, we use this sampling gradient and average over M=2M=2–33 fixed noise draws; deterministic heads use M=1M=1. Centered directional objective. Several natural ports fail on the evaluated flow head. Direct squared deviation, −‖a~θ−a~θ^‖22-\| a_θ- a_ θ\|_2^2, has zero gradient at θ=θ^θ= θ and cannot initialize first-order search. Driving a fixed valid action saturates empirically, while isotropic energy requires ∼10× 10× more flips (§6.5). We instead detach the clean action and optimize a one-sided displacement: Definition 3 (Fixed-direction manifold-escape objective). For a nonzero direction u∈ℝH×du ^H× d, define dθ(m)(o) d_θ^(m)(o) =a~θ(o,x1(m))−sg[a~θ^(o,x1(m))], = a_θ(o,x_1^(m))-sg\! [ a_ θ(o,x_1^(m)) ], (3) Ldir(θ,θ^) L_dir(θ; θ) =−1|cal|M∑o∈cal∑m=1M⟨dθ(m)(o),u⟩, =- 1|D_cal|M _o _cal _m=1^M d_θ^(m)(o),u , where sgsg denotes stop-gradient and the noise input is omitted for deterministic heads. Although Ldir(θ^,θ^)=0L_dir( θ; θ)=0, detaching the reference gives the same nonzero gradient as −⟨a~θ,u⟩- a_θ,u while making clean-action displacement explicit. We use u=u=1 and test −-1 plus three Gaussian directions in §6.5; positive rescaling does not change ranking. Sharing u gives traces a common action-space orientation without fitting a geometric manifold or forcing per-step gradient signs. Targeted diagnostics instead use Ltgt=o‖a~θ(o)−a⋆‖22L_tgt=E_o\| a_θ(o)-a \|_2^2. 5.2 Step 2: quantization-aware bit ranking Given LdirL_dir, which bits best solve Eq. (2)? Let gij(ℓ) g^( )_ij =∂Ldir∂Wij(ℓ)|θ=θ^, = . ∂ L_dir∂ W^( )_ij |_θ= θ, (4) sijb(ℓ) s^( )_ijb =g(ℓ)ijΔ(ℓ)ijb≈ΔL(ℓ)ijb,G(ℓ)ijb=−s(ℓ)ijb. =g^( )_ij ^( )_ijb≈ L^( )_ijb, G^( )_ijb=-s^( )_ijb. The score s predicts the loss change; G is positive when a flip improves the minimizing attack. Since LdirL_dir is a fixed action projection, Gijb(ℓ)=Δijb(ℓ)o,m[⟨da~θdWij(ℓ),u⟩]θ=θ^.G^( )_ijb= ^( )_ijb\,E_o,m\! [ d a_θdW^( )_ij,u ]_θ= θ. (5) Thus G combines directional action sensitivity with the quantization-dependent flip magnitude; it is a projection, not the full sensitivity norm. For each scalar weight we keep bij⋆=argmaxbGijb _ij= _bG_ijb, then select the K largest positive per-weight gains. Directional leverage is highly nonuniform, so this unrestricted ranking concentrates in a few action-generating layers without being told where to search (§6.4). The search requires one backward pass and scores eight bits per eligible weight, giving O(8Nw)=O(Nw)O(8N_w)=O(N_w) scoring cost. Its one-shot gradient ignores interactions among selected flips; progressive re-ranking can capture some interactions at higher cost, and §6.2 verifies that the low-budget discrete result survives canonical PBS. Algorithm 1 Quantization-aware fixed-direction bit search 1: quantized weights q(ℓ),s(ℓ)\q^( ),s^( )\, candidates C, calibration set calD_cal, direction u, noise draws M, budget K 2: g←∇WLdir(θ,θ^)|θ=θ^g← . _WL_dir(θ; θ) |_θ= θ 3: for each weight (ℓ,i,j)∈( ,i,j) do 4: compute Δijb(ℓ) ^( )_ijb and Gijb(ℓ)=−gij(ℓ)Δijb(ℓ)G^( )_ijb=-g^( )_ij ^( )_ijb for b=0,…,7b=0,…,7 5: bij⋆(ℓ)←argmaxbGijb(ℓ)b ( )_ij← _bG^( )_ijb, Gij(ℓ)←Gijbij⋆(ℓ)(ℓ)G^( )_ij← G^( )_ijb ( )_ij 6: ℱ←F← top-K positive-gain weights paired with b⋆b 7: return ℱF and θ^+δθ(ℱ) θ+δθ(F) The same algorithm collapses the discrete policy at K=3K=3, drives OFT’s action a full scale off, and, with the primary u=u=1, collapses π0 _0 at K≈100K≈100: one recipe whose empirical budget varies sharply with the action decoder. 6 Experiments Overview. Quantization makes the policy look safe: naive bit-flips leave the action essentially unchanged. Yet a gradient-ranked search that maximizes a fixed executed-action projection collapses closed-loop task success to zero, and the required budget spans two orders of magnitude across architectures. We establish the attack across this spectrum (§6.2), show that protecting ∼3 3–5%5\% of weights substantially raises the tested budget of a direct head (§6.3), and analyze localization and flow-head objectives (§6.4–6.5). 6.1 Experimental setup Models. We study three action-head families across four simulation model variants and five simulation checkpoints (33–77B, the 77B OpenVLA family and the ∼3.3 3.3B π0 _0/π0.5 _0.5): (i) OpenVLA-OFT (Kim et al. 2025) (continuous L1L_1-regression head, 8-step chunks), (i) discrete OpenVLA (256-bin action tokens emitted by the LLM head), (i) π0 _0 (flow-matching with a separate action expert, N=10N=10 denoising steps), and (iv) π0.5 _0.5 (Physical Intelligence et al. 2025) (a newer flow-matching VLA with a distinct architecture and weights, used to test whether the flow-matching findings generalize beyond a single model). (i)–(iv) are LIBERO-finetuned. For the cross-benchmark transfer we additionally use (v) the OXE-pretrained openvla-7b base policy (discrete token head, Google-Robot/Bridge embodiment). The real-robot study separately uses a real-trained π0.5 _0.5 checkpoint. Benchmarks. Closed-loop evaluation uses LIBERO (Liu et al. 2023) (four suites: Spatial, Object, Goal, Long) and SimplerEnv (Li et al. 2024) (ManiSkill2/SAPIEN, Google-Robot pick-coke-can and move-near). Quantization and attack surface. Weights are quantized per Def. 1. The attacker’s candidate set is every linear layer of the action-generating transformer (all decoder layers plus the action head/expert, 228228–437437 matrices), a realistic Rowhammer surface rather than the small head alone. The ranking gradient is accumulated over ≤6≤6 calibration frames, disjoint from evaluation. The attack is robust to both knobs: a single calibration frame already collapses the discrete policy at K=3K=3 (identical to 66 or 2020 frames), and either extreme direction works (push-high 0%0\%, push-low 5%5\% at K=3K=3, n=20n=20), so the attack does not depend on tuned hyperparameters. Metrics. (a) Open-loop action deviation: mean per-step L2L_2 between corrupted and clean executed actions on held-out frames (baseline action scale 0.8040.804 OFT // 0.1690.169 discrete // 0.6380.638 π0 _0). (b) Closed-loop success rate (SR): the fraction of successful rollouts. Headline endpoints use n=30n=30–5050 with Clopper-Pearson (exact binomial) 95%95\% intervals on 0/n0/n collapses, and the random-flip control reports a 5-seed mean± . (c) Safety predicates: per-step gripper inversion, out-of-envelope motion, and direction reversal for targeted diagnostics. Each closed-loop cell aggregates NTNT tasks ×EP×\,EP episodes. All simulated experiments use one NVIDIA A800; the physical-robot runtime is described separately in §6.2. Clean SR varies across experiments (discrete 8888–90%90\%, π0 _0 5757–70%70\%) because attacks use different small task–episode subsets; every attack is compared with the matched clean baseline from the same subset. Reproducibility. The appendices document the statistical protocol and additional diagnostics; ancillary code provides the attack, evaluation, analysis, and real-robot patching implementations. The π0 _0 direction sweep fixes seed 20260722, three calibration frames, two ranking-noise draws, and identical 30 rollout slots across directions. The fixed-path study independently reranks ten seeds (20260730–39), each with 17 held-out frames and three shared sampler-noise draws. These jobs use Ubuntu 22.04, Python 3.12, PyTorch 2.5, Transformers 4.53, LeRobot 0.4.4, and LIBERO 0.1.0; checkpoints, benchmark assets, calibration observations, robot videos, and experiment outputs are not redistributed. 6.2 The attack Naïve flips (premise). In bf16 a single magnitude-targeted exponent-MSB flip already moves the OFT action by 0.306 (38% of scale) and ≥10≥10 random flips produce NaNs (a denial-of-service), but this is a floating-point artifact. In the realistic INT8 regime, bounded values eliminate NaNs and naïve attacks fail: 300 random and 100 magnitude-targeted flips both leave the action within ∼0.004 0.004 of clean (Fig. 3), mirroring the BFA literature. Does INT8 also resist a gradient-ranked search? Figure 3: Three gradient-ranked INT8 flips move OpenVLA-OFT a full action scale; 300 naïve flips barely move it. Gradient-ranked bit search. Full-model gradient-PBS on OFT, over all 228 LLM-decoder + action-head linears: K=3→K=3→ deviation 0.828 (≈full scale), K=10→1.00K=10→ 1.00, K=100→1.13K=100→ 1.13, three orders of magnitude above naïve at matched budgets. The selected flips are dominated by LLM Layer 1 (earliest decoder layer) and the action head, the highest-leverage points on this direct head’s action pathway. Closed-loop task failure. Closed-loop LIBERO rollouts of discrete OpenVLA yield the suite-level results below: suite clean min K 95% upper rand.-300 Spatial (n=50n=50) 88.0% 3 ≤7.1%≤7.1\% 80.0% Object (n=30n=30) 80.0% 5 ≤11.6%≤11.6\% n/a Goal (n=30n=30) 83.3% 2 ≤11.6%≤11.6\% n/a Long (n=30n=30) 50.0% 1 ≤11.6%≤11.6\% n/a Table 1: Closed-loop attack results on four LIBERO suites. The discrete robot fails every task after 3 gradient-selected flips on LIBERO-Spatial (0/500/50 successes). The random-flip control is decisive: 300 random flips leave success near clean (80% vs. 88%, over 5 seeds 90.0%±5.4%90.0\%± 5.4\%, never collapsing), confirming the loss-aligned search, not the flip count, is the cause. Three flips induce only a modest per-step deviation (0.105) yet drive closed-loop success to zero: errors compound over the ∼200 200-step horizon. Consistent with horizon compounding, the longest-horizon suite (LIBERO-Long) collapses at a single flip (Table 1). The continuous-regression OFT head is even more fragile: a single gradient flip in its small, high-leverage action head collapses closed-loop success. Not all architectures are equally fragile, though: the flow-matching π0 _0 requires a different objective and a larger budget (§6.5). Progressive-ranking check. Although the main attack ranks once, we also run canonical PBS with a fresh gradient and ranking after every discrete-policy flip. Open-loop deviation is 0.0170.017, 0.0900.090, and 0.1530.153 at K=1,2,3K=1,2,3, respectively, and every selected bit remains in LLM L1. Thus the rapid low-budget damage and early-layer localization are not artifacts of a frozen ranking. All-linear weight quantization and lower precision. Table 2 summarizes the deployment-quantization checks. Quantizing every linear weight to INT8 preserves clean behavior and the direct-versus-flow budget gap. Lower precision does not remove the threat: per-channel INT4 reduces the discrete collapse budget to two flips, while usable group-wise INT4 preserves π0 _0’s ∼100 100-flip regime. For π0 _0, per-channel INT4 reduces clean SR to 10.0% as denoising accumulates quantization error, so we exclude it from attack-budget comparisons. policy stored-weight quantizer clean SR break K discrete INT8, all 437 linears 88.9% 3 π0 _0 INT8, all 422 linears 56.7% ∼100 100 discrete INT4, per-channel 76.7% 2 π0 _0 INT4, group-wise preserved ∼100 100 π0 _0 INT4, per-channel 10.0% n/a Table 2: Attack budgets under INT8 and INT4 quantization. For discrete INT4, SR drops from 76.7% clean to 46.7% at K=1K=1 and 0% at K=2K=2. These comparisons isolate stored-weight precision while ranking and arithmetic remain floating point. Cross-benchmark transfer. We also attack a different benchmark, embodiment, and checkpoint: the OXE-pretrained openvla-7b base policy on SimplerEnv (ManiSkill2/SAPIEN, Google Robot). On pick-coke-can, SR is 20.8%→0%20.8\%→ 0\% at K=3K=3 (random-300: 29.2%29.2\%). On the stronger move-near task it is 58.3%→12.5%58.3\%→ 12.5\% at K=3K=3, 4.2%4.2\% at K=5K=5, and 0%0\% at K=10K=10 (random-300: 41.7%41.7\%), all at n=24n=24 (Table 3). The higher-clean move-near task provides the stronger evidence; together, the results demonstrate transfer across benchmark, embodiment, and OXE- versus LIBERO-finetuned checkpoints. SimplerEnv task clean flips → 0% random pick-coke-can 20.8% 3 29.2% move-near 58.3% 10 41.7% Table 3: SimplerEnv attack results (n=24n=24 per task). Targeted action diagnostics. On held-out traces of the discrete policy, a target-action variant concentrates at low K on the most-sensitive gripper coordinate: K=3K=3 inverts the gripper command on 99%99\% of steps while leaving arm-motion deviation at ∼0.003 0.003. At K=30K=30, 60%60\% of commands leave the clean envelope and 41%41\% reverse direction. We report these outcomes as per-step open-loop safety diagnostics; closed-loop targeted behavior is outside this evaluation. Trigger-conditioned stealthiness (negative result). We additionally test a T-BFA-style goal: preserve clean behavior but alter it under a checkerboard trigger. The trigger separates clean and triggered attack gradients (cosine ≈0.24≈0.24) while leaving patch-only success near clean. An iterative search with a clean-preservation penalty keeps the clean action-token proxy within ±3±3 bins and drives the triggered proxy away over 30 flips, yet clean closed-loop SR still falls to 0%0\% at K=10K=10–3030. Thus we do not obtain a stealthy triggered backdoor. Real-robot study. On a 6-DoF place-block-in-bowl task, a collaborator patched a real-trained π0.5 _0.5 with task-calibrated dequantized values equivalent to K=100K=100 INT8 flips (99 readout coordinates, one expert). The patch yields 0/200/20 successes versus 14/2014/20 clean and 16/2016/20 equal-count global-random (Fig. 4; exact 95% CIs: [0,16.8]%[0,16.8]\%, [45.7,88.1]%[45.7,88.1]\%, and [56.3,94.3]%[56.3,94.3]\%). Two-sided Fisher tests give p<10−5p<10^-5 against either control; clean and random do not differ (p=.716p=.716). The directed list contains 100 distinct weight coordinates: 99 in action_out_proj and one in expert-L17, with 96 sign-bit and four bit-6 flips. The global-random list also uses 100 distinct coordinates but spans all eight bit positions. This study validates task-calibrated logical weight corruption on a real robot using an equal-count global-random control; end-to-end fault delivery and cross-task transfer remain open. Figure 4: Physical-robot rollouts on the calibrated blue-bowl task. Headers report 20-trial success; rows show stages under emulated INT8-equivalent patches. 6.3 Defense: Localized Integrity Protection We protect weights by removing them from the candidate set and rebuilding the attack, so every result is adaptive rather than a replay of fixed flips. Open loop, protecting the intuitive action head alone is useless: the attack pivots to L1 and still breaks at K=3K=3 (Table 4). Adding L1 raises the threshold to K=100K=100 (33×33×), while expanding coverage to L0–5 provides no further gain. protection weights break K dev.@K=3K=3 none 0.0% 3 0.83 action head 2.3% 3 0.75 head + L1 5.3% 100 0.14 L0–5 20.6% 100 0.12 Table 4: Adaptive open-loop defense (break: dev. >0.5>0.5). Closed loop requires only L1 (3.1%): success remains 80%, 83%, and 60% at K=3,10,100K=3,10,100 (Table 5). At matched K=3K=3, specific protection yields 24/3024/30 successes versus 0/300/30 unprotected and 3/303/30 for an equal-size random slice (two-sided Fisher p=3.3×10−11p=3.3×10^-11 and 5.6×10−85.6×10^-8, respectively). After L1 is excluded, the rebuilt ranking redistributes to later layers (L9, L19, and L23), yet 18/3018/30 trials still succeed at K=100K=100 (exact 95% CI: [40.6,77.3]%[40.6,77.3]\%). Survival through K=100K=100 therefore establishes an at-least 33×33× increase in the tested attack budget. protection weights SR@3 SR@10 SR@100 none 0.0% 0% 0% – early layer (L1) 3.1% 80% 83% 60% random slice 3.0% 10% n/a – Table 5: Adaptive closed-loop defense (clean 90%, n=30n=30). Scope and full-cost alternatives. Localized protection does not transfer to π0 _0: protecting 14% of its expert fails as the attack redistributes, so flow heads need broader coverage but already require ∼30× 30× more flips. Full checksums or ECC are the 100%-coverage endpoint of our defense. For a 7B-parameter INT8 model, one parity byte per eight data bytes alone adds roughly 0.90.9 GB, before verification cost; protecting the identified 3.13.1–5.3%5.3\% instead raises the tested direct-head budget while touching far less state. Weight shuffling provides no integrity by itself: a static layout may be recovered during memory templating, whereas repeatedly moving gigabytes of weights is bandwidth-heavy. It is therefore complementary to selective protection rather than an equal-cost substitute. 6.4 Where Damaging Bits Concentrate The highest-gain bits occupy small action-generating subsets, but their exact layer depends on the architecture. Localization across architectures. On discrete OpenVLA, K=3K=3 gives deviation 0.105 and 0%0\% closed-loop SR, with top flips in LLM L1. On π0 _0, K=3K=3 gives 0.363 deviation, with flips in the action expert; the primary objective favors expert-L17 across 5 noise seeds rather than the vision-language backbone (Fig. 5). Thus high-leverage layers are sparse but architecture dependent. Figure 5: Layer localization among the top-100 flips (blank cells are zero). Direct heads concentrate in LLM L1, whereas π0 _0 concentrates in its final expert layer (5-seed mean). This localization result is distinct from the budget spectrum: it identifies where an attack enters each model, not why one decoder needs more flips than another. 6.5 Flow-Head Objective Analysis We next isolate the role of the executed-action objective on the evaluated flow heads. Complete flow-head budget curves. Table 6 makes the primary fixed-direction endpoints explicit. On π0 _0/Spatial, the attack removes roughly half the clean successes by K=30K=30 and reaches 0%0\% at ∼100 100; on Object it leaves only 3.3%3.3\% at K=100K=100. The distinct π0.5 _0.5 reaches 0%0\% at K=300K=300, supporting the empirical ∼100 100–300300 flow-head regime. policy/suite clean directed SR@K random SR@K π0 _0/Spatial 70.0% ∼12 12 clean@30; 0.0%@∼100 100 ∼ clean@300 π0 _0/Object 86.7% 3.3%@100 70.0%@100 π0.5 _0.5/Spatial 93.3% 66.7%@30; 30.0%@100; 0.0%@300 96.7%@300 Table 6: Closed-loop flow-head budgets (n=30n=30). Exact n=30n=30 counts for the latter two rows are π0 _0/Object 26/1/2126/1/21 clean/directed/random at K=100K=100, and π0.5 _0.5/Spatial 28/3028/30 clean, 20/9/020/9/0 directed at K=30/100/300K=30/100/300, and 29/3029/30 random-300300. For the controlled objective comparison on π0 _0/Spatial, isotropic energy instead requires ∼1000 1000 flips to reach 0%0\% (n=50n=50; random 76.0%), ten times the fixed-direction budget. fixed direction successes SR ↓ 95% CI clean (no flips) 18/30 60.0% [40.6, 77.3] ++1 2/30 6.7% [0.8, 22.1] −-1 8/30 26.7% [12.3, 45.9] random u0u_0 2/30 6.7% [0.8, 22.1] random u1u_1 2/30 6.7% [0.8, 22.1] random u2u_2 4/30 13.3% [3.8, 30.7] Table 7: Matched fixed-direction π0 _0 trials at K=100K=100 (n=30n=30). Objective-direction robustness. We repeat the K=100K=100 π0 _0/LIBERO-Spatial attack with ++1, −-1, and three independent Gaussian unit directions. Each receives a fresh one-shot ranking; 414 candidate linears, three calibration frames, two noise draws, quantization, and the same 30 task–episode seeds are fixed. From the matched 18/3018/30 clean rate, the random directions yield 2/302/30, 2/302/30, and 4/304/30 successes; −-1 is weaker (8/308/30; Table 7). After Bonferroni correction across the five directions, ++1 and all random directions remain significant (adjusted p≤2.6×10−3p≤ 2.6×10^-3), whereas −-1 does not (raw p=.031p=.031, adjusted p=.154p=.154). Thus direction affects strength, but the result is not all-positive-specific. Every ranking stays in the action expert, usually with 81–92 flips in L17; one random direction splits between L0 (44) and L17 (43). attack direct, K=3K=3 π0 _0 flow clean 90% 70% random-300 90% ∼ clean magnitude-3 90% ∼ clean token-CE 0% n/a self-deviation n/a 76.7% at K=1000K=1000 isotropic max‖a‖2 \|a\|^2 0% 0% at ∼1000 1000 manifold escape 0% 0% at ∼100 100 Table 8: Head-specific empirical collapse budgets. Attack comparison. Table 8 separates head-specific ports. On the direct head, any gradient-aligned objective collapses at K=3K=3, whereas random and magnitude baselines remain at clean SR; without iterative decoding, objective design matters little. On π0 _0, the direct self-deviation port remains at 76.7% SR at K=1000K=1000 because its clean-initialization gradient is zero. The meaningful nonzero-gradient comparison is therefore isotropic energy versus manifold escape, which require ∼1000 1000 and ∼100 100 flips, respectively. Step-effect consistency across rerankings. Across ten K=100K=100 rerankings (51 shared traces each), fixed-direction coherence is 1.0001.000 versus 0.9690.969 for energy. Differences are positive/tied in 7/37/3 cases (one-sided Wilcoxon p=.0078p=.0078), with mean 0.0310.031 (95% CI [−0.019,0.081][-0.019,0.081]). Architecture-level synthesis. Together, the results separate where faults enter from how they propagate: localization guides protection, while decoder architecture and directional consistency shape the empirical closed-loop budget. Limitations and ethics. Reported K budgets measure logical INT8 susceptibility, not hardware-independent margins; physical fault delivery and ECC remain outside scope. This dual-use study is intended to motivate integrity protection. 7 Conclusion Selected INT8 flips collapse random-fault-tolerant VLAs: 1–5 for direct heads versus ∼100 100–300300 for the evaluated flow heads. Fixed-direction manifold escape cuts π0 _0’s budget tenfold, works across five directions, and guides protection through K=100K=100. Physical-robot trials validate task-calibrated failure. This architecture-aware view links attack construction to selective protection. It also motivates decoder-aware fault evaluation before deployment. For direct heads, localized integrity checks offer a practical starting point. Weight integrity is therefore a VLA security boundary. References Rakin et al. (2019) A. S. Rakin et al. Bit-Flip Attack: Crushing Neural Network with Progressive Bit Search. ICCV 2019. Yao et al. (2020) F. Yao et al. DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flips. USENIX Security 2020. Lin et al. (2025) C. S. Lin, J. Qu, and G. Saileshwar. GPUHammer: Rowhammer Attacks on GPU Memories are Practical. USENIX Security 2025. Hu et al. (2026) Y. Hu, N. Brown, Y. Chen, J. Bakita, T. Chen, D. Genkin, and A. Kwong. GDDRHammer: Greatly Disturbing DRAM Rows—Cross-Component Rowhammer Attacks from Modern GPUs. IEEE S&P 2026. Rakin et al. (2022) A. S. Rakin et al. T-BFA: Targeted Bit-Flip Adversarial Weight Attack. IEEE TPAMI 2022. Rakin et al. (2021) A. S. Rakin et al. RA-BNN: Constructing Robust & Accurate Binary Neural Network to Simultaneously Defend Adversarial Bit-Flip Attack and Improve Accuracy. arXiv:2103.13813. Kim et al. (2024) M. J. Kim et al. OpenVLA: An Open-Source Vision-Language-Action Model. CoRL 2024 (arXiv:2406.09246). Black et al. (2024) K. Black et al. π0 _0: A Vision-Language-Action Flow Model for General Robot Control. arXiv:2410.24164. Zitkovich et al. (2023) B. Zitkovich et al. RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Control. CoRL 2023. Zhou et al. (2025) X. Zhou, G. Tie, G. Zhang, H. Wang, P. Zhou, and L. Sun. BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization. arXiv:2505.16640. Wang et al. (2025) H. Wang, C. Xiong, R. Wang, and X. Chen. BitVLA: 1-bit Vision-Language-Action Models for Robotics Manipulation. arXiv:2506.07530. Khalil and Hoque (2025) K. Khalil and K. A. Hoque. FlipLLM: Efficient Bit-Flip Attacks on Multimodal LLMs using Reinforcement Learning. arXiv:2512.09872. Galil et al. (2026) I. Galil, M. Kimhi, and R. El-Yaniv. Maximal Brain Damage Without Data or Optimization: Disrupting Neural Networks via Sign-Bit Flips. TMLR 2026 (arXiv:2502.07408). Zhou et al. (2024) X. Zhou, S. Kundu, D. Chen, J. Huang, and P. A. Beerel. What Makes Vision Transformers Robust Towards Bit-Flip Attack? ICPR 2024. Chen et al. (2024) Y. Chen et al. Diffusion Policy Attacker: Crafting Adversarial Attacks for Diffusion-based Policies. NeurIPS 2024 (arXiv:2405.19424). Qi and Xu (2024) Z. Qi and X. Xu. TrojFlow: Flow Models are Natural Targets for Trojan Attacks. arXiv:2412.16512. Wang et al. (2024) X. Wang et al. TrojanRobot: Physical-World Backdoor Attacks Against VLM-Based Robotic Manipulation. arXiv:2411.11683. Huang et al. (2025) Y. Huang et al. ANNIE: Be Careful of Your Robots. arXiv:2509.03383. Li et al. (2025) J. Li, Y. Zhao, X. Zheng, Z. Xu, Y. Li, X. Ma, and Y.-G. Jiang. AttackVLA: Benchmarking Adversarial and Backdoor Attacks on Vision-Language-Action Models. arXiv:2511.12149. Xu et al. (2025) Z. Xu, J. Li, Y. Zhao, X. Zheng, X. Ma, and Y.-G. Jiang. DropVLA: An Action-Level Backdoor Attack on Vision-Language-Action Models. arXiv:2510.10932. Zhang et al. (2026) J. Zhang, Y. Hsieh, Z. Wan, H. Lin, X. Wang, Z. Wang, Y. Lei, and M. Zhang. QuantVLA: Scale-Calibrated Post-Training Quantization for Vision-Language-Action Models. arXiv:2602.20309. Akbari et al. (2026) A. Akbari et al. ActQuant: Sub-4-bit Action-Guided Quantization for Vision-Language-Action Models. arXiv:2605.24011. Hong et al. (2021) S. Hong et al. Qu-ANTI-zation: Exploiting Quantization Artifacts for Achieving Adversarial Outcomes. NeurIPS 2021. Gao et al. (2024a) Y. Gao, H. Chen, P. Sun, J. Li, A. Zhang, Z. Wang, and W. Liu. A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectives. AAAI 2024, p. 1851–1859. Gao et al. (2024b) Y. Gao, H. Chen, P. Sun, Z. Li, J. Li, and H. Shao. Energy-Based Backdoor Defense without Task-Specific Samples and Model Retraining. ICML 2024, p. 14611–14637. Chi et al. (2025) C. Chi et al. Diffusion Policy: Visuomotor Policy Learning via Action Diffusion. IJRR 44(10–11):1684–1704, 2025. Lipman et al. (2023) Y. Lipman et al. Flow Matching for Generative Modeling. ICLR 2023. He et al. (2020) Z. He et al. Defending and Harnessing the Bit-Flip Based Adversarial Weight Attack. CVPR 2020. Li et al. (2021) J. Li et al. RADAR: Run-time Adversarial Weight Attack Detection and Accuracy Recovery. DATE 2021. Chen et al. (2025) Y. Chen et al. BitShield: Defending Against Bit-Flip Attacks on DNN Executables. NDSS 2025. Kim et al. (2025) M. J. Kim, C. Finn, and P. Liang. Fine-Tuning Vision-Language-Action Models: Optimizing Speed and Success. arXiv:2502.19645. Physical Intelligence et al. (2025) Physical Intelligence et al. π0.5 _0.5: A Vision-Language-Action Model with Open-World Generalization. arXiv:2504.16054. Liu et al. (2023) B. Liu, Y. Zhu, C. Gao, Y. Feng, Q. Liu, Y. Zhu, and P. Stone. LIBERO: Benchmarking Knowledge Transfer for Lifelong Robot Learning. NeurIPS Datasets and Benchmarks 2023. Li et al. (2024) X. Li et al. Evaluating Real-World Robot Manipulation Policies in Simulation. CoRL 2024 (arXiv:2405.05941). Yu et al. (2025) J. Yu, H. Chen, J. Li, L. Chen, Y. Gao, W. Liu, and L. Zhang. Black-Box Adversarial Defense Based on Image Decomposition and Reconstruction. IEEE Transactions on Multimedia, 27:5909–5921, 2025. Appendix A Additional Statistical and Reproducibility Details A.1 Code and environment The ancillary code contains reusable INT8 quantization and bit-ranking utilities; implementations for the direct, discrete-token, π0 _0, and π0.5 _0.5 experiments; analysis code for the fixed-direction study; and the real-robot patch-and-restore utility. It intentionally excludes checkpoints, benchmark assets, calibration observations, selected patch lists, robot videos, and experiment outputs. The π0 _0 jobs used one NVIDIA A800 under Ubuntu 22.04.3, Python 3.12.12, PyTorch 2.5.0, Transformers 4.53.3, LeRobot 0.4.4, and LIBERO 0.1.0. The direction sweep fixes seed 20260722, three calibration frames, two ranking-noise draws, and 30 rollout slots per condition. The multi-seed fixed-path study independently reranks seeds 20260730–39, using three calibration frames, two ranking-noise draws, and 17 held-out frames with three shared evaluation-noise draws per seed. A.2 Real-robot aggregate results Table 9 aggregates the blue-bowl trials used in the main paper. Confidence intervals are two-sided Clopper–Pearson intervals. condition success SR exact 95% CI clean 14/2014/20 70.0% [45.7,88.1]%[45.7,88.1]\% directed K=100K=100 0/200/20 0.0% [0.0,16.8]%[0.0,16.8]\% global-random K=100K=100 16/2016/20 80.0% [56.3,94.3]%[56.3,94.3]\% Table 9: Physical-robot success on the blue-bowl task. Two-sided Fisher exact tests give p=×10−6p=3.34\!×\!10^-6 for directed versus clean and p=×10−7p=1.54\!×\!10^-7 for directed versus global-random; clean versus global-random is not distinguishable (p=0.716p=0.716). These comparisons do not establish task transfer, and the random control is not layer/bit matched. A.3 Fixed-path consistency diagnostic At K=100K=100, corrupted velocities are re-evaluated at every clean denoising state, and coherence is |∑kck|/∑k|ck|| _kc_k|/ _k|c_k|. A single expanded ranking paired on 17 held-out frames and three shared noise draws (n=51n=51 traces) gave coherence 1.0001.000 versus 0.9980.998 and did not resolve a difference (p=.159p=.159). Because the independently rebuilt ranking is the relevant experimental unit, we then fixed a ten-seed protocol before inspecting its results. Each seed reranks both objectives and averages the same 51 within-seed traces. Fixed direction has coherence 1.0001.000 for all ten seeds, whereas energy averages 0.9690.969: seven paired differences are positive, three are ties, and none is negative (one-sided Wilcoxon p=.0078p=.0078). The mean difference is 0.0310.031, but its 95% CI is wide ([−0.019,0.081][-0.019,0.081]). Thus the experiment supports a tendency toward more consistent step effects, while the tenfold closed-loop budget gap remains an empirical objective comparison rather than an identified causal mechanism. Layer identity varies across ranking seeds. Manifold-escape flips usually concentrate in Expert-L17, consistent with the 5-seed localization study, whereas energy often favors Expert-L12 and sometimes Expert-L0. The supported claim is concentration in a small action-expert subset, not invariance of one exact layer. A.4 Attack-port comparison The direct-head result reduces to gradient-ranked bit search, while the relevant flow-head comparison separates zero-gradient and nonzero-gradient objectives: attack direct, K=3K=3 π0 _0 flow clean 90% 70% random-300 90% ∼ clean magnitude-3 90% ∼ clean token-CE 0% n/a self-deviation n/a 76.7% at K=1000K=1000 isotropic max‖a‖2 \|a\|^2 0% 0% at ∼1000 1000 manifold escape 0% 0% at ∼100 100 Table 10: Head-specific empirical collapse budgets. Appendix B Exploratory Flow-Attenuation Analysis These exploratory diagnostics probe why the two evaluated flow-matching policies have high attack budgets. They neither isolate decoder dynamics causally nor predict closed-loop bit budgets. B.1 Endpoint sensitivity to initial-noise perturbations We perturb initial noise by ϵdε d for random unit d and measure ρend=‖Δa‖/‖Δnoise‖ _ end=\| a\|/\| \,noise\| (n=24n=24 per ϵε). It is 0.160.16–0.380.38 for π0 _0 and 0.040.04–0.220.22 for π0.5 _0.5 over ϵ∈0.1,0.3,1.0ε∈\0.1,0.3,1.0\. These finite endpoint ratios show shrinkage but neither identify the symmetric part of JxJ_x nor verify Jx+Jx⊤⪯−2μIJ_x+J_x -2μ I; κend=−lnρend _ end=- _ end is descriptive only. They also do not predict budget ordering: π0.5 _0.5 has larger first-order per-flip open-loop damage despite its higher closed-loop budget. B.2 Solver-depth diagnostic We rebuild each attack for N∈2,5,10,20N∈\2,5,10,20\ denoising steps. Increasing N changes discretization, not the learned vector field, so it is not a controlled intervention on contraction. At fixed budget, isotropic open-loop deviation falls roughly 2×2× (0.0570.057 at N≤5N≤ 5 to 0.0250.025 at N=20N=20), while manifold escape collapses success at every N. This establishes objective efficacy across solver depths but does not identify cancellation or contractivity; moreover, the deviation result is open-loop and the closed-loop sample (n=12n=12) is too noisy for a stronger claim. Appendix C Conditional First-Order Contraction Bound This section records a sufficient-condition analysis that helps organize intuition. The condition is not verified by the endpoint diagnostic above, and the bound is not used to estimate any experimental budget. Proposition 1 (Budget lower bound from contraction). Write denoising in forward time s∈[0,1]s∈[0,1], with x˙s=vθ(xs,s,c) x_s=v_θ(x_s,s,c) and executed action a=x1a=x_1. Partition weights into blocks θ=θℓθ=\ _ \ and let Lℓ:=sups‖∂θℓvθ‖L_ := _s\| _ _ v_θ\|. Suppose Jx=∂vθ/∂xJ_x=∂ v_θ/∂ x satisfies Jx+Jx⊤⪯−2μIJ_x+J_x -2μ I along the sampling trajectory for μ>0μ>0. Then the first-order action variation satisfies ‖δa‖≤C(μ)∑ℓLℓ‖δθℓ‖,C(μ)=1−e−μ.\|δ a\|≤ C(μ) _ L_ \|δ _ \|, C(μ)= 1-e^-μ. If each of K INT8 flips changes one weight by at most b and Lmax=maxℓLℓL_ = _ L_ , reaching first-order open-loop deviation D requires K≥D/[LmaxbC(μ)]K≥ D/[L_ bC(μ)]. Here LℓL_ describes where a perturbation enters the vector field and C(μ)C(μ) how a contractive trajectory would attenuate it. Since C(μ)→1C(μ)→ 1 as μ→0μ→ 0, the unattenuated first-order case is recovered. This is an open-loop upper bound, not an equality or closed-loop certificate; direct heads lie outside its premise. Task tolerance, bit values, nonlinear interactions, and feedback can dominate, so budgets are measured rather than inferred. Proof. For each block, Sℓ=∂xs/∂θℓS_ =∂ x_s/∂ _ obeys S˙ℓ=JxSℓ+∂θℓv S_ =J_xS_ + _ _ v, Sℓ(0)=0S_ (0)=0. The hypothesis gives ‖Φ(1,s)‖≤e−μ(1−s)\| (1,s)\|≤ e^-μ(1-s) and thus ‖Sℓ(1)δθℓ‖≤LℓC(μ)‖δθℓ‖\|S_ (1)δ _ \|≤ L_ C(μ)\|δ _ \|. Sum over blocks and use ∑ℓ‖δθℓ‖≤Kb _ \|δ _ \|≤ Kb. ∎