Paper deep dive
CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models
Hui Lu, Zhijie Peng, Yuqi Lin, Zaijia Yang, Jiaming He, Shuhan Ye, Yi Yu, Hanwei Zhu, Bingquan Shen, Alex Kot, Xudong Jiang
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%
Last extracted: 8/24/2026, 5:18:20 AM
Summary
The paper introduces CertVLA, a certified defense mechanism for Vision-Language-Action (VLA) models against physical visual attacks, such as localized patches and textures. Unlike existing defenses that target discrete labels, CertVLA certifies continuous, temporally correlated actions in closed-loop control. It employs a calibrated region of behaviorally consistent actions and deterministic covering masks to ensure that at least one prediction is attack-free. The method normalizes action disagreement by benign variation and uses a max-min-max episode score to provide finite-sample clean coverage. The authors prove that under a bounded-support threat model, every rollout certified by CertVLA executes actions consistent with attack-erased clean predictions, guaranteeing task success under dual-mask rollout correctness. Experiments in simulation and real-world settings demonstrate the effectiveness of CertVLA.
Entities (7)
Relation Signals (5)
CertVLA → defendsagainst → Physical Visual Attacks
confidence 95% · CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models
CertVLA → targets → Vision-Language-Action models
confidence 95% · We introduce CertVLA, a certified defense for closed-loop VLA control
CertVLA → uses → Covering Masks
confidence 92% · CertVLA proposes a calibrated region of behaviorally consistent actions, while deterministic covering masks ensure that at least one checked prediction is attack-free.
CertVLA → providesguaranteeunder → Bounded-Support Threat Model
confidence 90% · against any adaptive attacker satisfying the bounded-support threat model, every rollout certified by CertVLA executes only action chunks consistent with attack-erased clean predictions.
PatchCleanser → influenced → CertVLA
confidence 85% · Following PatchCleanser (41), we enumerate K deterministic masks
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Vision-Language-Action (VLA) policies are vulnerable to localized physical perturbations, yet existing certified patch defenses target discrete labels and cannot directly certify continuous, temporally correlated actions. We introduce CertVLA, a certified defense for closed-loop VLA control under bounded patch and texture attacks. CertVLA proposes a calibrated region of behaviorally consistent actions, while deterministic covering masks ensure that at least one checked prediction is attack-free. Specifically, CertVLA normalizes action disagreement by the benign variation of each mask pair and accepts a single-mask anchor only when it remains consistent under every second mask. It then calibrates the resulting max-min-max episode score to provide finite-sample clean coverage. Conjoining query-level decisions extends the action certificate to the complete closed-loop rollout. Furthermore, we prove that against any adaptive attacker satisfying the bounded-support threat model, every rollout certified by CertVLA executes only action chunks consistent with attack-erased clean predictions. Under dual-mask rollout correctness, this consistency certificate further guarantees task success. The certificate is independent of patch content, generation method, and physical transformation. Experiments in simulation and the real world demonstrate the empirical and certified effectiveness of CertVLA against patch attacks, with additional simulation validation on texture attacks.
Tags
Links
- Source: https://arxiv.org/abs/2608.20791v1
- Canonical: https://arxiv.org/abs/2608.20791v1
Trouble viewing inline? Open PDF directly →
Full Text
51,840 characters extracted from source content.
Expand or collapse full text
CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models Hui Lu Zhijie Peng Yuqi Lin Zaijia Yang Jiaming He Shuhan Ye Yi Yu Hanwei Zhu Bingquan Shen Alex Kot Xudong Jiang Abstract Vision-Language-Action (VLA) policies are vulnerable to localized physical perturbations, yet existing certified patch defenses target discrete labels and cannot directly certify continuous, temporally correlated actions. We introduce CertVLA, a certified defense for closed-loop VLA control under bounded patch and texture attacks. CertVLA proposes a calibrated region of behaviorally consistent actions, while deterministic covering masks ensure that at least one checked prediction is attack-free. Specifically, CertVLA normalizes action disagreement by the benign variation of each mask pair and accepts a single-mask anchor only when it remains consistent under every second mask. It then calibrates the resulting max-min-max episode score to provide finite-sample clean coverage. Conjoining query-level decisions extends the action certificate to the complete closed-loop rollout. Furthermore, we prove that against any adaptive attacker satisfying the bounded-support threat model, every rollout certified by CertVLA executes only action chunks consistent with attack-erased clean predictions. Under dual-mask rollout correctness, this consistency certificate further guarantees task success. The certificate is independent of patch content, generation method, and physical transformation. Experiments in simulation and the real world demonstrate the empirical and certified effectiveness of CertVLA against patch attacks, with additional simulation validation on texture attacks. Introduction Vision-Language-Action (VLA) models connect visual perception and language instructions directly to robot control, enabling general-purpose policies for diverse manipulation tasks (52; 34; 1; 36). This tight perception-action coupling also creates a physical attack surface: a localized patch in the scene or an adversarial texture on an object can persist across viewpoints and corrupt an entire closed-loop trajectory. Recent attacks have demonstrated such failures across tasks, VLA architectures, and sim-to-real settings (39; 31; 4). Existing empirical defenses improve VLA robustness through robust training, decoupled robustness learning, safety-constrained optimization, and noise-filtering modules (9; 44; 8), while patch-specific defenses in vision typically localize, mask, or restore suspicious regions (38; 45; 15; 47). For safety-critical deployment, however, empirical robustness alone is insufficient, as resistance to tested attacks does not establish robustness to all attacks within the threat model (6; 19; 41). A certified defense should additionally determine when the executed actions are provably protected against every admissible attack. Existing certified patch defenses provide a natural starting point for this goal. Prior work has developed deterministic ablation, restricted receptive fields, and masking-based approaches to certify discrete predictions against bounded patch attacks (18; 40). Extending this paradigm to VLAs, however, requires addressing fundamental differences between discrete perception and embodied control. First, VLAs typically produce continuous action chunks, for which exact agreement among masked outputs is generally too restrictive and a measurable notion of action consistency is needed. Second, although covering-based masking (32; 41) can handle an unknown patch location, its discrete recovery criterion does not directly apply to continuous actions. The defender must instead determine whether a recovered action remains within a calibrated region of an attack-erased reference without knowing which mask removes the attack. Third, VLA actions are executed in closed loop. A certificate at one policy query only constrains the current action chunk, while its execution changes the state and observations encountered at subsequent queries. Certification must therefore extend from individual predictions to the sequence of decisions made along the actual rollout. Hence, a research question arises naturally: How can we certify continuous VLA actions against unknown bounded physical perturbations and extend the guarantee from individual policy queries to closed-loop task execution? In response, we introduce CertVLA, a model-agnostic certified defense for continuous VLA control under bounded patch and texture attacks. CertVLA uses an ℛR-covering mask family (41) so that, for any admissible support, at least one evaluated mask completely erases the corrupted region. Because different mask positions induce different benign action changes, we normalize each anchored dual-mask disagreement by a position-specific clean scale and calibrate a shared tolerance with held-out clean episodes. The resulting max-min-max score exactly represents the required ∀-query–∃-anchor–∀-second-mask decision. At deployment, an early-stopped recovery rule rejects a row as soon as it cannot pass and returns a certified anchor only if all second-mask checks pass. This construction yields a deliberately layered guarantee. Whenever CertVLA certifies a query, the returned action chunk lies in a calibrated clean-consistency region of a prediction for which the attack has been erased. The statement holds for arbitrary patch content and adaptive attack generation, provided that the attack support can be fully enclosed by a fixed-size square region. Conjoining query-level flags extends the result to the complete executed rollout, even when the admissible patch location changes over time. Under an explicit dual-mask rollout-correctness condition, the same certificate further implies terminal task success. The contributions of our paper are summarized as follows: • We formulate certified defense for continuous closed-loop VLA control and introduce a calibrated action-consistency region beyond exact label agreement. • We develop an anchored dual-mask defense that couples position-aware normalization with a covering-based recovery rule for certifiable action selection. • We prove query- and episode-level consistency guarantees against any bounded-support adaptive attacker, and isolate the precise additional condition under which this observable certificate guarantees task completion. • Extensive experiments across multiple VLAs, attack types, and deployment settings demonstrate the broad applicability of CertVLA. Figure 1: CertVLA framework. Top: clean single- and dual-mask predictions estimate the position-scale matrix Q and calibrate threshold τ. Bottom: at each query, CertVLA returns a single-mask anchor only if it is consistent with every second-mask prediction, then composes query flags into an episode certificate distinct from empirical task success. Related Work VLA models. VLA policies map vision and language directly to robot actions. Early scaling were established by RT-1, PaLM-E, and RT-2 (2; 7; 52). RoboFlamingo adapts open VLMs through imitation learning, whereas Open X-Embodiment and Octo exploit heterogeneous cross-robot data (25; 35; 34). OpenVLA provides an open 7B policy and OpenVLA-OFT improves action generation through parallel decoding and action chunking (17; 16). π0 _0 and π0.5 _0.5 policies use flow matching and heterogeneous co-training for dexterous, open-world control (1; 36). Recent VLAs continue to improve generalization, cross-embodiment control, and closed-loop manipulation through larger-scale training, experience-driven learning, and active perception (13; 28), while their certifiable robustness to physical adversarial perturbations remains largely unexplored. Adversarial attacks & defense in robotics. Printable patches remain effective across physical transformations (3). RoboticAttack demonstrates untargeted, trajectory-targeted, and physical attacks on VLA control, while UPA-RFAS transfers patches across architectures, tasks, viewpoints, and sim-to-real settings (39; 31). Tex3D further turns 3D object textures into persistent attack surfaces (4). Recent defenses improve empirical stability to visual or multimodal perturbations (9; 44; 8), but their observed robustness does not provide a per-rollout guarantee against adaptive attacks. CertVLA instead certifies any visible corruption whose projected support satisfies the bounded-region threat model. Certified defenses against patch attacks. Patch certificates use interval bounds or deterministic ablation (5; 18), restricted receptive fields and masking (40; 42), or occlusion consistency (33; 41). ScaleCert improves high-resolution certification, PatchCURE exposes tunable robustness–utility–efficiency trade-offs, and CertMask reduces redundant mask evaluations (12; 43; 32). PatchDEMUX extends single-label certificates to multi-label prediction (14). Nevertheless, these guarantees rely on discrete label or detection decisions. Exact agreement is unsuitable for continuous, temporally correlated action chunks, and an isolated prediction certificate does not cover states reached later in a rollout. CertVLA addresses both gaps through calibrated anchored consistency and episode-level composition. Preliminaries VLA Policy and Threat Model Let xt=(xtext,xtwrist,st)x_t=(x_t^ext,x_t^wrist,s_t) contain the external-camera image, wrist-camera image, and proprioceptive state at policy query index t, respectively, and let ℓ be a language instruction. A VLA policy π produces an action chunk At=π(xt,ℓ)∈⊆ℝH×D,A_t=π(x_t, ) ^H× D, (1) of horizon H and action dimension D. The controller executes only the first h≤Hh≤ H actions before next query. The adversary may arbitrarily replace pixels in a single connected region Ωt _t whose image-plane footprint belongs to a known family ℛ(P)R(P), where P is the certified maximum side length and ℛ(P)R(P) contains every axis-aligned region no larger than P×P× P pixels. For either camera view, xtΩ=(1−Ωt)⊙xt+Ωt⊙δt.x_t =(1-1_ _t) x_t+1_ _t _t. (2) Here Ωt1_ _t is the binary indicator of the attacked support, δt _t is arbitrary adversarial pixel content, and ⊙ denotes elementwise multiplication. Superscript Ω denotes the resulting attacked observation. We make no assumptions about the patch content, generation method, location, or physical transformation. Our certification only requires that its projected support in each defended view lies within a region in ℛ(P)R(P). Covering Masks and Action Predictions The patch location is unknown at inference time, so no single predetermined mask can guarantee removal. Following PatchCleanser (41), we enumerate K deterministic masks, where index i∈1,…,Ki∈\1,…,K\ and operator MiM_i overwrites a fixed region with a benign value. The covering property guarantees that, for any admissible bounded patch, the candidate set contains at least one mask that completely removes its support, independent of the patch appearance. Definition 1 (ℛR-covering family) A deterministic family ℳ=M1,…,MKM=\M_1,…,M_K\ is ℛR-covering if, for every Ω∈ℛ(P) (P), some mask Mj⋆M_j overwrites all pixels in Ω . For a query (x,ℓ)(x, ), we define the unmasked, single-mask, and anchored dual-mask predictions A0=π(x,ℓ),Ai=π(Mi(x),ℓ),Ai,j=π(Mj(Mi(x)),ℓ). \!\!A_0\!=\!π(x, ),~A_i\!=\!π(M_i(x), ),~A_i,j\!=\!π(M_j(M_i(x)), ). (3) For an attacked input xΩx , superscript Ω denotes the analogous predictions AiΩ=π(Mi(xΩ),ℓ)A_i =π(M_i(x ), ) and Ai,jΩ=π(Mj(Mi(xΩ)),ℓ)A_i,j =π(M_j(M_i(x )), ). This notation separates the attacked quantities observed at deployment from their clean counterparts. The single-mask prediction AiA_i, rather than every pair of dual-mask predictions, will serve as the anchor of a candidate recovery row. Methodology Overview. Fig. 1 summarizes CertVLA’s calibration and deployment stages. On clean episodes, CertVLA normalizes mask-dependent action variation and calibrates an episode-level threshold. At deployment, it returns a single-mask anchor only when the anchor is consistent with every second-mask prediction, and certifies the rollout only if every policy query passes. The covering property then ties each certified action to a clean prediction from which the attack is erased. Continuous-Action Consistency Score Unlike discrete labels (41; 32), behaviorally equivalent action chunks need not match exactly. We therefore measure normalized action deviation and account for the distinct benign scale of each ordered mask pair. Directional action distance. Let [au−,au+][a_u^-,a_u^+] be the valid range of action coordinate u∈1,…,Du∈\1,…,D\ and define d(A,B) d(A,B) =1hD∑r=1h∑u=1D|Ar,u−Br,u|ηu(Br,u), = 1hD _r=1^h _u=1^D |A_r,u-B_r,u| _u(B_r,u), (4) ηu(b) _u(b) =max|au+−b|,|b−au−|,ϵ. = \|a_u^+-b|,|b-a_u^-|,ε\. Here A,B∈ℝH×DA,B ^H× D are respectively the dual-mask chunk and single-mask anchor, r indexes the h executed actions, and u indexes action coordinates. The denominator normalizes each coordinate by its valid range, with ϵ>0ε>0 ensuring numerical stability. Because it is evaluated at the anchor B, d(A,B)d(A,B) is directional. Position-scale matrix. Mask pairs occlude different scene content and therefore have different clean deviation scales. Let e index an episode, q∈1,…,Neqryq∈\1,…,N_e qry\ a policy query, NeqryN_e qry the number of queries, and i,j∈1,…,Ki,j∈\1,…,K\ an ordered mask pair. Let Ae,q,iA_e,q,i and Ae,q,i,jA_e,q,i,j be the corresponding single- and dual-mask predictions. From clean scale-calibration episodes scaleC_ scale, we collect i,jscale=d(Ae,q,i,j,Ae,q,i): _i,j scale=\d(A_e,q,i,j,A_e,q,i): e∈scale, e _ scale, q=1,…,Neqry, q=1,…,N_e qry\, (5) and set its reference scale to the fixed β-quantile, Qi,j=Quantile^β(i,jscale).Q_i,j= Quantile_β (D_i,j scale ). (6) where β∈(0,1)β∈(0,1) is chosen before row calibration. The matrix =[Qi,j]∈ℝ≥0K×KQ=[Q_i,j] _≥ 0^K× K removes pair-specific scale. Algorithm 1 Position-Aware Episode Calibration 0: Scale episodes scaleC_ scale; row episodes rowC_ row; masks ℳM; quantile β; clean-episode miscoverage level α; ϵε 0: Position-scale matrix =[Qi,j]Q=[Q_i,j] and threshold τ 1: # Stage I: position-scale estimation 2: for i=1i=1 to K do 3: for j=1j=1 to K do 4: i,jscale←d(Ae,q,i,j,Ae,q,i):e∈scale,q=1,…,NeqryD_i,j scale←\d(A_e,q,i,j,A_e,q,i):e _ scale,q=1,…,N_e qry\; Qi,j←Quantile^β(i,jscale)Q_i,j← Quantile_β(D_i,j scale) 5: end for 6: end for 7: # Stage I: episode-level joint calibration 8: for all e∈rowe _ row do 9: ze,q,i,j←d(Ae,q,i,j,Ae,q,i)/(Qi,j+ϵ)z_e,q,i,j← d(A_e,q,i,j,A_e,q,i)/(Q_i,j+ε) for all q,i,jq,i,j 10: Se←maxqminimaxjze,q,i,jS_e← _q _i _jz_e,q,i,j 11: end for 12: τ←Q^1−αconf(Se)τ← Q conf_1-α(\S_e\) 13: return (,τ)(Q,τ) Position-Aware Clean-Consistency Calibration The local scales Q make mask pairs comparable but do not set a joint acceptance threshold. We therefore calibrate an episode-level normalized radius τ, using disjoint scale and row splits to preserve the exchangeability required for conformal calibration. We define normalized consistency score ze,q,i,j=d(Ae,q,i,j,Ae,q,i)Qi,j+ϵ,z_e,q,i,j= d(A_e,q,i,j,A_e,q,i)Q_i,j+ε, (7) where ϵε handles zero empirical variation. Thus ze,q,i,jz_e,q,i,j measures deviation relative to the clean behavior of the same ordered pair, enabling a shared threshold across positions. Definition 2 (Pair-specific clean-consistency region) For an ordered mask pair (i,j)(i,j), anchor action B∈B , and tolerance τ≥0τ≥ 0, define ℬi,j(B,τ):=A∈:d(A,B)≤τ(Qi,j+ϵ).B_i,j(B;τ):=\A :d(A,B)≤τ(Q_i,j+ε)\. (8) We call A (i,j,τ)(i,j,τ)-consistent with B when A∈ℬi,j(B,τ)A _i,j(B;τ). Here, τ(Qi,j+ϵ)τ(Q_i,j+ε) is the raw tolerance for pair (i,j)(i,j). Lemma 1 (Score-region equivalence) For every episode e, policy query q, ordered mask pair (i,j)(i,j), and tolerance τ≥0τ≥ 0, ze,q,i,j≤τ⟺Ae,q,i,j∈ℬi,j(Ae,q,i;τ).z_e,q,i,j≤τ A_e,q,i,j _i,j(A_e,q,i;τ). (9) The equivalence follows from Qi,j+ϵ>0Q_i,j+ε>0. Stage I calibrates the event dictated by ℛR-covering: at each query, some row must be consistent for every second mask, including the unknown mask that erases the patch: e(τ):=[∀q∃i∀j:Ae,q,i,j∈ℬi,j(Ae,q,i;τ)]. Pass_e(τ):= [∀ q\;∃ i\;∀ j:A_e,q,i,j _i,j(A_e,q,i;τ) ]. (10) Its scalar score is Se=maxqminimaxjze,q,i,j.S_e= _q _i _jz_e,q,i,j. (11) Here maxj _j, mini _i, and maxq _q implement ∀j∀ j, ∃i∃ i, and ∀q∀ q, respectively. Consequently, SeS_e is the minimum threshold required for every policy query in episode e to admit at least one row whose normalized disagreement remains within the threshold for all second-mask positions. Lemma 2 (Score-quantifier equivalence) For all episode e and threshold τ≥0τ≥ 0, we have (proof in Supplementary.): Se≤τ⟺e(τ)⟺∀q∃i∀j:ze,q,i,j≤τ. S_e≤τ Pass_e(τ) ∀ q\;∃ i\;∀ j:\ z_e,q,i,j≤τ. (12) Episode-level conformal calibration. Although Q normalizes the location-dependent disagreement of individual mask pairs, the aggregated score SeS_e can still vary across clean episodes due to variations in initial states, object configurations, executed trajectories, and policy-query sequences. We therefore calibrate the global acceptance threshold at the episode level rather than fixing it heuristically. Let α∈(0,1)α∈(0,1) denote the target clean-episode miscoverage rate. Given n=|row|n=|C_ row| calibration episodes with ordered scores S(1)≤⋯≤S(n)S_(1)≤·s≤ S_(n), we set τ=S(k),k=⌈(n+1)(1−α)⌉,τ=S_(k), k= (n+1)(1-α) , (13) provided that k≤nk≤ n. Under the standard exchangeability assumption between the calibration episodes and a future clean episode, this conformal quantile provides finite-sample marginal coverage Pr(Snew≤τ)≥1−α. (S_ new≤τ)≥ 1-α. (14) Equivalently, a new clean episode is rejected because its consistency score exceeds τ with probability at most α. Thus, α controls the allowed clean-episode rejection rate, while τ is the corresponding data-dependent tolerance for episode-level action consistency. A smaller α yields a larger τ, reducing clean rejection at the cost of a looser consistency certificate. Algorithm design. Alg. 1 partitions clean, unattacked episodes into scaleC_ scale and rowC_ row. Stage I estimates each ordered-pair scale Qi,jQ_i,j by Eq. (6) and freezes Q before Stage I. At deployment, fixed Qi,jQ_i,j supplies the pair-specific unit and fixed τ thresholds the joint score. Together, Lemmas 1 and 2 give the exact action-region and episode-level interpretations. Lemma 3 (Finite-sample clean coverage) If the row-calibration episodes and a future new episode are exchangeable, Alg. 1 satisfies Pr[Snew≤τ]≥1−α [S_ new≤τ]≥ 1-α. Equivalently, with probability at least 1−α1-α, the future episode satisfies ∀q∃i∀j:Anew,q,i,j∈ℬi,j(Anew,q,i,τ)∀ q\,∃ i\,∀ j:A_ new,q,i,j _i,j(A_ new,q,i;τ). This clean-coverage result is separate from the deterministic patch-erasure certificate. See Supplementary for the proof. Algorithm 2 DualMaskRecover 0: (x,ℓ)(x, ); VLA π; masks ℳM; Q; τ; ϵε 0: Action A A, selected row i i, flag c 1: Rbest←+∞R_ best←+∞; Abest←π(x,ℓ)A_ best←π(x, ); i^←0 i← 0 2: for i=1i=1 to K do 3: Ai←π(Mi(x),ℓ)A_i←π(M_i(x), ); Ri←0R_i← 0 4: for j=1j=1 to K do 5: Ai,j←π(Mj(Mi(x)),ℓ)A_i,j←π(M_j(M_i(x)), ) 6: Ri←maxRi,d(Ai,j,Ai)Qi,j+ϵR_i← \! \R_i, d(A_i,j,A_i)Q_i,j+ε \ 7: if Ri>τR_i>τ then 8: break 9: end if 10: end for 11: if Ri<RbestR_i<R_ best then 12: (Rbest,Abest,i^)←(Ri,Ai,i)(R_ best,A_ best, i)←(R_i,A_i,i) 13: end if 14: if Ri≤τR_i≤τ then 15: return (Ai,i,true)(A_i,i,true) 16: end if 17: end for 18: return (Abest,i^,false)(A_ best, i,false) Anchored Dual-Mask Recovery The patch location is unknown, so each first-mask prediction serves as an anchor and is checked against every second mask. By ℛR-covering, at least one check erases the patch. Lemma 4 (Attack erasure) Let xΩx differ from x only on Ω∈ℛ(P) (P), and let each mask overwrite its support with fixed values. If ℳM is ℛR-covering, some Mj⋆M_j covers Ω and, for every Mi∈ℳM_i , Mj⋆(Mi(xΩ))=Mj⋆(Mi(x)).M_j (M_i(x ))=M_j (M_i(x)). (15) Alg. 2 updates a running row score as second masks are evaluated. Because this score is nondecreasing, a row can be safely discarded as soon as it exceeds τ. A row that survives all K checks has the complete score Ri=max1≤j≤Kd(Ai,j,Ai)Qi,j+ϵ.R_i= _1≤ j≤ K d(A_i,j,A_i)Q_i,j+ε. (16) The algorithm immediately returns the first complete row satisfying Ri≤τR_i≤τ. Hence c=truec=true only after verifying every second mask, whereas early stopping merely avoids unnecessary evaluations of a rejected row. If no row passes, it returns the anchor with the smallest observed partial score as an explicitly uncertified fallback. Algorithm 3 Defended Rollout Evaluation 0: Environment ℰE; instruction ℓ ; VLA π; masks ℳM; Q; τ; ϵε; horizon T 0: Task outcome SdefS_ def and episode flag C 1: Reset ℰE; C←trueC ; Sdef←falseS_ def 2: for t=0t=0 to T−1T-1 do 3: if a new policy query is required then 4: (A~t,i^t,ct)←DualMaskRecover(xt,ℓ,π,ℳCLOSE,( A_t, i_t,c_t)← DualMaskRecover(x_t, ,π,M, 5: OPEN,τ,ϵ)Q,τ,ε); C←C∧ctC← C c_t 6: end if 7: Execute the next action from A~t A_t in ℰE 8: if task success then 9: Sdef←trueS_ def ; break 10: end if 11: end for 12: return (Sdef,C)(S_ def,C) Theorem 1 (Attack-erased consistency) Let xΩx be any attacked input with Ω∈ℛ(P) (P). If Alg. 2 returns (A^,i^,c)( A, i,c) with c=truec=true, then A^=Ai^Ω A=A_ i and there exists a clean dual-masked prediction Ai^,j⋆A_ i,j such that Ai^,j⋆∈ℬi^,j⋆(A^,τ),A_ i,j _ i,j ( A;τ), (17) or, equivalently, d(Ai^,j⋆,A^)≤τ(Qi^,j⋆+ϵ)≤τ(Qi^max+ϵ),d(A_ i,j , A)≤τ(Q_ i,j +ε)≤τ(Q_ i +ε), (18) where Mj⋆M_j covers Ω and Qi^max=maxjQi^,jQ_ i = _jQ_ i,j. The bound is independent of the patch content, shape, attack-generation method, and physical transformation, provided that the attack support Ω∈ℛ(P) (P) satisfies the certified size bound and can therefore be fully covered by at least one mask in ℳM. See Supplementary for proof. Notably, Theorem 1 certifies action consistency, not unconditional task success. For practical utility, the patch-erased prediction should also preserve task-relevant behavior. Supplementary empirically validates this property across VLA models under random single- and dual-masking. Closed-Loop Episode Certificate Action consistency certification alone does not imply terminal task success. Following PatchCleanser’s two-mask correctness (41), we state the required closed-loop condition for continuous actions. Definition 3 (Dual-mask rollout correctness) Let qryT_ qry denote the policy-query times of a defended rollout, and let A~t A_t be the recovered action chunk executed at query time t. A task, policy, and environment satisfy dual-mask rollout correctness if every defended rollout for which ∀t∈qry,∃(it,jt):At,it,jtclean∈ℬit,jt(A~t,τ)∀ t _ qry, ∃(i_t,j_t): A clean_t,i_t,j_t _i_t,j_t( A_t;τ) (19) reaches the task-success set. Here At,it,jtcleanA clean_t,i_t,j_t denotes the patch-erased dual-mask prediction evaluated at the same reached state as A~t A_t. Attack Type ↓ Model ↓ LIBERO-Spatial LIBERO-Object LIBERO-Goal LIBERO-Long Average Defense Certified Defense Certified Defense Certified Defense Certified Defense Certified Patch attack (39; 31) OpenVLA† 96 96 96 64 96 94 88 76 94.00 82.50 OpenVLA-OFT 98 98 94 94 98 98 86 86 94.00 94.00 π0 _0 82 36 92 84 86 61 74 66 83.50 61.75 π0.5 _0.5 96 72 97 89 84 68 86 77 90.75 76.50 Texture attack (4) OpenVLA† 84 82 77 30 83 83 37 30 70.25 56.25 OpenVLA-OFT 88 88 94 92 90 90 40 37 78.00 76.75 π0 _0 88 38 92 80 82 62 74 70 84.00 62.50 π0.5 _0.5 100 92 94 88 94 88 90 86 94.50 88.50 Table 1: Defense and certified task success rates (%) against physical patch and adversarial object texture attacks on LIBERO. Average denotes the mean performance across the four LIBERO suites. † denotes our dual-mask fine-tuned model, and fine-tuning details are provided in Appendix . At each t∈qryt _ qry, Alg. 3 invokes Alg. 2, executes from the recovered chunk A~t A_t, and accumulates C=⋀t∈qryctC= _t _ qryc_t. Because Eq. (4) jointly scores its action chunk, aggregation is per query. The outputs separate defended success SdefS_ def, episode certification C, and certified success Sdef∧CS_ def C, and any uncertified fallback makes C false. Theorem 2 (Closed-loop consistency certificate) Suppose every query’s patch support belongs to ℛ(P)R(P) and ℳM is ℛR-covering. If Alg. 3 returns C=trueC=true, then at every t∈qryt _ qry there exist indices (it,jt⋆)(i_t,j_t ) and an attack-erased clean prediction satisfying At,it,jt⋆clean∈ℬit,jt⋆(A~t,τ).A clean_t,i_t,j_t _i_t,j_t ( A_t;τ). (20) This remains valid if the admissible patch location changes between queries. Theorem 2 certifies the observable action sequence, and the following lemma states when this consistency also guarantees task success. Lemma 5 (Conditional closed-loop task certificate) Under Theorem 2, if the task also satisfies Definition 3, then C=trueC=true implies Sdef=trueS_ def=true for every admissible patch sequence. Together, the theorem and lemma provide a layered certificate tailored to closed-loop continuous control: CertVLA first verifies an attacker-independent action-consistency property and invokes the explicit rollout-correctness condition only for the stronger task-success claim. This separation keeps the guarantee logically transparent while allowing SdefS_ def, C, and Sdef∧CS_ def C to be evaluated without conflating empirical success with certification. Experiments Dataset & threat models. We use LIBERO (27), a simulated manipulation benchmark, and evaluate its Spatial, Object, Goal, and Long suites with 10 tasks for each, including spatial relations, object interaction, goal-conditioned control, and multi-stage execution. We report results for four VLA policies: OpenVLA (17), OpenVLA-OFT (16), π0 _0 (1), and π0.5 _0.5 (36), across all suites. Attacks are physical patches (39; 31) and adversarial object textures (4). In both cases, the visible image-plane corruption must satisfy the bounded-support threat model. Evaluation metrics & details. For each model, task suite, and attack setting, we evaluate N closed-loop episodes per suite. Defense reports the defended task success rate, N−1∑e=1N[Sedef=1]N^-1 _e=1^NI[S_e def=1], where SedefS_e def denotes task success under defense. Certified reports N−1∑e=1N[Sedef=1∧Ce=true]N^-1 _e=1^NI[S_e def=1 C_e=true], where CeC_e means all policy queries in episode e pass the consistency test. Thus, Certified counts only defended successes with an end-to-end certificate. We set β=0.95β=0.95, α=0.5α=0.5, and ϵ=10−8ε=10^-8 for all main results. See Supplementary for more experimental details. Physical Experiment Setting. For real-world experiments, we employ a dual-arm Piper robotic platform. Each arm is controlled using a 7-dimensional end-effector action. We use one arm to implement the pick-and-place task. Visual observations are provided by two RGB cameras: one Intel RealSense D435 camera offering a third-person view and one Intel RealSense D405 camera mounted on the wrist. Our policy uses these synchronized RGB observations together with the arm proprioceptive state. We use standardized objects and workspace layouts for systematic quantitative evaluation, with the task repeated for 10 independent trials. Model Clean Attack Defense Certified π0.5 _0.5 90 40 60 30 Table 2: Results for physical patch attacks on the real robot. Figure 2: Real-robot rollouts across successive policy queries. The bottom row is diagnostic: it visualizes the dual-mask candidate with the smallest normalized score z at each query. The white outline identifies the anchor mask of the accepted row. Figure 3: Sensitivity to mask-set size, certified patch size, mask size, pair-scale quantile β, and conformal level α (left to right). Blue and orange report Defense and Certified task success; green reports the corresponding auxiliary quantity on the right axis. Main Results Defense against patch & texture attack in simulation. In Tab. 1, OpenVLA-OFT obtains 94%94\% average Defense and Certified success, while OpenVLA† reaches 94%94\% Defense and 82.5%82.5\% Certified success. The larger gaps for the generative policies show that some successful rollouts contain a query outside the calibrated region, confirming the value of reporting empirical recovery and certification separately. Defense against texture attack shows transfer beyond planar patches. π0.5 _0.5 performs best, averaging 94.5%94.5\% Defense and 88.5%88.5\% Certified success; π0 _0 reaches 84%84\% and 62.5%62.5\%, respectively. OpenVLA variants are less stable on the Long suite. The result matches our support-based threat model: certification depends on covering the visible corruption, not on how its texture was generated. Defense against physical real patch attack. Quantitative results. Tab. 2 shows that the patch reduces π0.5 _0.5 success from 90%90\% to 40%40\%. CertVLA reaches 60%60\%, a 20-point gain that recovers 40% of the attack-induced loss. Its 30%30\% Certified success means that half of the successfully defended trials pass at every query. The remaining Defense-Certified gap identifies successful rollouts with at least one query outside the calibrated region. It reflects a stricter certificate under physical environment. Qualitative analysis. Fig. 2 separates execution from diagnostic checks. Its third row shows only a reference dual-mask candidate. The one with minimum z-score at each query is illustrated, which does not select the action. Alg. 2 instead finds an anchor i whose entire row satisfies zi,j≤τz_i,j≤τ (∃i∀j∃ i\,∀ j). The white box marks this anchor, and AiA_i is predicted from an input masking only its pixels. The other black region visualizes one second-mask check and is absent during execution. Thus, dual masks establish the certificate while the executed single-mask input retains more task-relevant content. Discussion Covering, utility, and calibration trade-offs. Fig. 3 analyzes the principal design parameters from left to right. Let P, M, and s denote the patch side length, mask side length, and mask stride. The mask family is ℛR-covering only if P≤M−s+1P≤ M-s+1 so only configurations satisfying this constraint are considered. Across these valid configurations, π0 _0 maintains a consistently high Defense rate, whereas OpenVLA-OFT is more sensitive to the masking configuration. With P=38P=38 fixed, increasing the mask set provides denser coverage and permits smaller masks, reducing visual occlusion at the cost of more mask evaluations. This substantially improves OpenVLA-OFT Defense, whileπ remains consistently high. Certified success also increases for both models, indicating that finer coverage benefits both task utility and certifiable consistency. With M=75M=75 fixed, larger certified patches require denser mask placement and a larger mask set to maintain ℛR-coverage. But both Defense and Certified rates decrease as P grows, showing that certifying a larger attack region places greater demands on the masked policy. With the mask set fixed at 8×88×8, increasing M enlarges the occluded region while keeping the number of candidate masks unchanged. Both Defense and Certified rates decrease as M grows, indicating that larger masks remove more task-relevant visual information and make the recovered actions less reliable. The degradation is stronger for OpenVLA-OFT, whereas π remains more stable, showing greater tolerance to increased occlusion under the same covering density. Calibration is also policy dependent. Increasing β rescales Qi,jQ_i,j and changes normalized τ non-monotonically, and we set it to 0.950.95 to mitigate the influence of extreme values while preventing an overly large τ and an excessively loose certificate. Reducing α raises acceptance for both policies but loosens the consistency region (Lemma 3). Neither parameter replaces ℛR-covering for deterministic patch erasure. Interpreting the certification gap. Defense success measures if the recovered policy completes a task, whereas Certified success additionally requires every executed query to satisfy the calibrated consistency test. A rollout may therefore succeed yet remain uncertified because of one ambiguous observation. Small gaps indicate stable masked actions throughout an episode, while larger gaps expose queries that may gain from improved masked-model utility or calibration. Conclusion CertVLA provides a certified defense for continuous closed-loop VLA control by combining position-normalized action consistency and episode-level calibration. Our analysis establishes query- and rollout-level guarantees that relate certified actions to attack-erased predictions under bounded-support attacks, with task success further guaranteed when dual-mask rollout correctness holds. Experiments demonstrate both empirical defense effectiveness and certifiable robustness across VLA models and physical attacks. References Black et al. (2024) K. Black, N. Brown, D. Driess, et al. π0 _0: A vision-language-action flow model for general robot control. arXiv preprint arXiv:2410.24164. External Links: Link Cited by: Introduction, VLA models., Dataset & threat models.. Brohan et al. (2022) A. Brohan, N. Brown, J. Carbajal, et al. RT-1: robotics transformer for real-world control at scale. arXiv preprint arXiv:2212.06817. Cited by: VLA models.. Brown et al. (2017) T. B. Brown, D. Mané, A. Roy, M. Abadi, and J. Gilmer Adversarial patch. arXiv preprint arXiv:1712.09665. External Links: Link Cited by: VLA models.. Chen et al. (2026) J. Chen, S. Huang, J. Du, S. Chen, Y. Tian, M. Wei, C. Yu, and Z. Yin Tex3D: objects as attack surfaces via adversarial 3d textures for vision-language-action models. arXiv preprint arXiv:2604.01618. External Links: Link Cited by: Introduction, VLA models., Table 1, Dataset & threat models.. Chiang et al. (2020) P. Chiang, R. Ni, A. Abdelkader, C. Zhu, C. Studor, and T. Goldstein Certified defenses for adversarial patches. In International Conference on Learning Representations, External Links: Link Cited by: Certified defenses against patch attacks.. Cohen et al. (2019) J. Cohen, E. Rosenfeld, and Z. Kolter Certified adversarial robustness via randomized smoothing. In Proceedings of the 36th International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 97, p. 1310–1320. Cited by: Introduction. Driess et al. (2023) D. Driess, F. Xia, M. S. M. Sajjadi, et al. PaLM-E: an embodied multimodal language model. In International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 202. Cited by: VLA models.. Fu et al. (2026) Y. Fu, C. Zhang, S. Gong, Y. Deng, K. Sun, Q. Min, Q. Hou, Y. Tang, J. Wang, and D. Zhou StableVLA: towards robust vision-language-action models without extra data. In International Conference on Machine Learning, Cited by: Introduction, VLA models.. Guo et al. (2025) J. Guo, Z. Wu, C. Tu, Y. Ma, X. Kong, Z. Liu, J. Ji, S. Zhang, Y. Chen, K. Chen, X. Liu, Q. Dou, Y. Yang, H. Zhao, W. Lv, and S. Li On robustness of vision-language-action model against multi-modal perturbations. arXiv preprint arXiv:2510.00037. Cited by: Introduction, VLA models.. Guo and Kankanhalli (2025) Y. Guo and M. Kankanhalli Scan: bootstrapping contrastive pre-training for data efficiency. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 3662–3672. Cited by: CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models. Guo et al. (2022) Y. Guo, L. Nie, Y. Wong, Y. Liu, Z. Cheng, and M. Kankanhalli A unified end-to-end retriever-reader framework for knowledge-based vqa. In Proceedings of the 30th ACM International Conference on Multimedia, p. 2061–2069. Cited by: CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models. Han et al. (2021) H. Han, K. Xu, X. Hu, X. Chen, L. Liang, Z. Du, Q. Guo, Y. Wang, and Y. Chen ScaleCert: scalable certified defense against adversarial patches with sparse superficial layers. In Advances in Neural Information Processing Systems, Vol. 34. Cited by: Certified defenses against patch attacks.. Intelligence et al. (2025) P. Intelligence, A. Amin, R. Aniceto, A. Balakrishna, K. Black, K. Conley, G. Connors, J. Darpinian, K. Dhabalia, J. DiCarlo, et al. π0.6∗π^*_0.6: A vla that learns from experience. arXiv preprint arXiv:2511.14759. Cited by: VLA models.. Jacob et al. (2025) D. Jacob, C. Xiang, and P. Mittal PatchDEMUX: a certifiably robust framework for multi-label classifiers against adversarial patches. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 9944–9953. Cited by: Certified defenses against patch attacks.. Jing et al. (2024) L. Jing, R. Wang, W. Ren, X. Dong, and C. Zou PAD: patch-agnostic defense against adversarial patch attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 24472–24481. Cited by: Introduction. Kim et al. (2025a) M. J. Kim, C. Finn, and P. Liang Fine-tuning vision-language-action models: optimizing speed and success. arXiv preprint arXiv:2502.19645. Cited by: VLA models., Dataset & threat models.. Kim et al. (2025b) M. J. Kim, K. Pertsch, S. Karamcheti, et al. OpenVLA: an open-source vision-language-action model. In Conference on Robot Learning, Vol. 270, p. 2679–2713. External Links: Link Cited by: VLA models., Dataset & threat models.. Levine and Feizi (2020a) A. Levine and S. Feizi (De)randomized smoothing for certifiable defense against patch attacks. In Advances in Neural Information Processing Systems, Vol. 33. External Links: Link Cited by: Introduction, Certified defenses against patch attacks.. Levine and Feizi (2020b) A. Levine and S. Feizi Robustness certificates for sparse adversarial attacks by randomized ablation. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 34, p. 4585–4593. External Links: Document Cited by: Introduction. Li et al. (2025a) L. Li, P. Cai, R. A. Rossi, F. Dernoncourt, B. Kveton, J. Wu, T. Yu, L. Song, T. Yang, Y. Qin, N. K. Ahmed, S. Basu, S. Mukherjee, R. Zhang, Z. Hu, B. Ni, Y. Zhou, Z. Wang, Y. Huang, Y. Wang, X. Zhang, P. S. Yu, X. Hu, and Y. Zhao A personalized conversational benchmark: towards simulating personalized conversations. External Links: 2505.14106, Link Cited by: CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models. Li et al. (2024) L. Li, W. Ji, Y. Wu, M. Li, Y. Qin, L. Wei, and R. Zimmermann Panoptic scene graph generation with semantics-prototype learning. Proceedings of the AAAI Conference on Artificial Intelligence 38 (4), p. 3145–3153. External Links: Link, Document Cited by: CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models. Li et al. (2023a) L. Li, C. Wang, Y. Qin, W. Ji, and R. Liang Biased-predicate annotation identification via unbiased visual predicate representation. In Proceedings of the 31st ACM International Conference on Multimedia, M ’23, New York, NY, USA, p. 4410–4420. External Links: ISBN 9798400701085, Link, Document Cited by: CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models. Li et al. (2025b) S. Li, P. Cai, Y. Zhou, Z. Ni, R. Liang, Y. Qin, Y. Nian, Z. Tu, X. Hu, and Y. Zhao Secure on-device video ood detection without backpropagation. In International Conference on Computer Vision (ICCV), Cited by: CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models. Li et al. (2025c) S. Li, H. Gong, H. Dong, T. Yang, Z. Tu, and Y. Zhao DPU: dynamic prototype updating for multimodal out-of-distribution detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 10193–10202. Cited by: CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models. Li et al. (2023b) X. Li, M. Liu, H. Zhang, et al. Vision-language foundation models as effective robot imitators. arXiv preprint arXiv:2311.01378. Cited by: VLA models.. Liang et al. (2023) R. Liang, Y. Yang, H. Lu, and L. Li Efficient temporal sentence grounding in videos with multi-teacher knowledge distillation. arXiv preprint arXiv:2308.03725. Cited by: CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models. Liu et al. (2023) B. Liu, Y. Zhu, C. Gao, Y. Feng, Q. Liu, Y. Zhu, and P. Stone LIBERO: benchmarking knowledge transfer for lifelong robot learning. In Advances in Neural Information Processing Systems, Vol. 36. Cited by: Dataset & threat models.. Liu et al. (2026) Z. Liu, Y. Gu, Y. Wang, X. Xue, and Y. Fu ActiveVLA: injecting active perception into vision-language-action models for precise 3d robotic manipulation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 8141–8151. Cited by: VLA models.. Lu et al. (2025) H. Lu, Y. Yu, S. Xia, Y. Yang, D. Rajan, B. P. Ng, A. Kot, and X. Jiang From pretrain to pain: adversarial vulnerability of video foundation models without task knowledge. arXiv preprint arXiv:2511.07049. Cited by: CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models. Lu et al. (2026a) H. Lu, Y. Yu, Y. Yang, C. Yi, X. Ke, Q. Zhang, B. Shen, A. Kot, and X. Jiang Universal adversarial attacks against closed-source mllms via target-view routed meta optimization. arXiv preprint arXiv:2601.23179. Cited by: CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models. Lu et al. (2026b) H. Lu, Y. Yu, Y. Yang, C. Yi, Q. Zhang, B. Shen, A. C. Kot, and X. Jiang When robots obey the patch: universal transferable patch attacks on vision-language-action models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 22867–22878. Cited by: Introduction, VLA models., Table 1, Dataset & threat models.. Lyu et al. (2026) X. Lyu, C. Lin, A. Al Arafat, G. von der Brüggen, J. Chen, and Z. Guo CertMask: certifiable defense against adversarial patches via theoretically optimal mask coverage. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 40, p. 7735–7743. External Links: Document Cited by: Introduction, Certified defenses against patch attacks., Continuous-Action Consistency Score. McCoyd et al. (2020) M. McCoyd, W. Park, S. Chen, N. Shah, R. Roggenkemper, M. Hwang, J. X. Liu, and D. Wagner Minority reports defense: defending against adversarial patches. arXiv preprint arXiv:2004.13799. Cited by: Certified defenses against patch attacks.. Octo Model Team et al. (2024) Octo Model Team D. Ghosh et al. Octo: an open-source generalist robot policy. In Robotics: Science and Systems, External Links: Link Cited by: Introduction, VLA models.. Open X-Embodiment Collaboration et al. (2023) Open X-Embodiment Collaboration, A. O’Neill, A. Rehman, et al. Open x-embodiment: robotic learning datasets and RT-X models. arXiv preprint arXiv:2310.08864. Cited by: VLA models.. Physical Intelligence et al. (2025) Physical Intelligence, K. Black, N. Brown, et al. π0.5 _0.5: A vision-language-action model with open-world generalization. arXiv preprint arXiv:2504.16054. External Links: Link Cited by: Introduction, VLA models., Dataset & threat models.. Shawn et al. (2025) L. Shawn, J. Qu, L. Song, Y. Zhou, Y. Qin, T. Yang, and Y. Zhao Treble counterfactual VLMs: a causal approach to hallucination. In Association for Computational Linguistics: EMNLP 2025, Suzhou, China, p. 18423–18434. External Links: ISBN 979-8-89176-335-7 Cited by: CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models. Tarchoun et al. (2023) B. Tarchoun, A. Ben Khalifa, M. A. Mahjoub, N. Abu-Ghazaleh, and I. Alouani Jedi: entropy-based localization and removal of adversarial patches. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 4087–4095. Cited by: Introduction. Wang et al. (2025) T. Wang, D. Liu, J. C. Liang, W. Yang, Q. Wang, C. Han, J. Luo, and R. Tang Exploring the adversarial vulnerabilities of vision-language-action models in robotics. In IEEE/CVF International Conference on Computer Vision, p. 6948–6958. External Links: Link Cited by: Introduction, VLA models., Table 1, Dataset & threat models.. Xiang et al. (2021) C. Xiang, A. N. Bhagoji, V. Sehwag, and P. Mittal PatchGuard: a provably robust defense against adversarial patches via small receptive fields and masking. In 30th USENIX Security Symposium, p. 2237–2254. Cited by: Introduction, Certified defenses against patch attacks.. Xiang et al. (2022) C. Xiang, S. Mahloujifar, and P. Mittal PatchCleanser: certifiably robust defense against adversarial patches for any image classifier. In 31st USENIX Security Symposium, p. 2065–2082. Cited by: Introduction, Introduction, Introduction, Certified defenses against patch attacks., Covering Masks and Action Predictions, Continuous-Action Consistency Score, Closed-Loop Episode Certificate. Xiang and Mittal (2021) C. Xiang and P. Mittal PatchGuard++: efficient provable attack detection against adversarial patches. arXiv preprint arXiv:2104.12609. Cited by: Certified defenses against patch attacks.. Xiang et al. (2024) C. Xiang, T. Wu, S. Dai, J. Petit, S. Jana, and P. Mittal PatchCURE: improving certifiable robustness, model utility, and computation efficiency of adversarial patch defenses. In 33rd USENIX Security Symposium, p. 3675–3692. Cited by: Certified defenses against patch attacks.. Xie et al. (2026) Y. Xie, Y. Yan, Y. Zhao, H. Wang, and Y. Jin STRONG-VLA: decoupled robustness learning for vision-language-action models under multimodal perturbations. arXiv preprint arXiv:2604.10055. Cited by: Introduction, VLA models.. Xu et al. (2023) K. Xu, Y. Xiao, Z. Zheng, K. Cai, and R. Nevatia PatchZero: defending against adversarial patch attacks by detecting and zeroing the patch. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, p. 4632–4641. Cited by: Introduction. Yang et al. (2025) Y. Yang, Y. Guo, H. Lu, and Y. Wang VidLBEval: benchmarking and mitigating language bias in video-involved lvlms. arXiv preprint arXiv:2502.16602. Cited by: CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models. Yankelev et al. (2026) I. Yankelev, E. Grolman, Y. Y. Levi, A. Giloni, O. Hofman, T. Shimizu, Y. Elovici, and A. Shabtai AntiStyler: defending object detection models against adversarial patch attacks using style removal. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 27936–27945. Cited by: Introduction. Yu et al. (2025a) Y. Yu, S. Xia, X. Lin, C. Kong, W. Yang, S. Lu, Y. Tan, and A. C. Kot Towards model resistant to transferable adversarial examples via trigger activation. IEEE Transactions on Information Forensics and Security. Cited by: CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models. Yu et al. (2025b) Y. Yu, S. Xia, X. Lin, W. Yang, S. Lu, Y. Tan, and A. Kot Backdoor attacks against no-reference image quality assessment models via a scalable trigger. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 39, p. 9698–9706. Cited by: CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models. Yu et al. (2025c) Y. Yu, S. Xia, S. Yang, C. Kong, W. Yang, S. Lu, Y. Tan, and A. C. Kot MTL-UE: learning to learn nothing for multi-task learning. CoRR abs/2505.05279. External Links: Link, Document, 2505.05279 Cited by: CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models. Yu et al. (2024) Y. Yu, Q. Zheng, S. Yang, W. Yang, J. Liu, S. Lu, Y. Tan, K. Lam, and A. Kot Unlearnable examples detection via iterative filtering. In International Conference on Artificial Neural Networks, p. 241–256. Cited by: CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models. Zitkovich et al. (2023) B. Zitkovich et al. RT-2: vision-language-action models transfer web knowledge to robotic control. In Conference on Robot Learning, p. 2165–2183. Cited by: Introduction, VLA models.. 48, 21, 22, 24, 23, 37, 51, 46, 20, 26, 29, 11, 10, 50, 49, 30