Research map / Large language models / Reasoning and chain of thought

TRAP: Hijacking VLA CoT-Reasoning via Adversarial Patches

ICML 2026 · Large language models › Reasoning and chain of thought · approach: Long CoT dynamics and efficiency · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes TRAP, an adversarial-patch attack that hijacks the chain-of-thought reasoning of reasoning VLA models to force targeted robot behaviors without changing the user instruction, validated in simulation and with a printed patch in the real world.

Problem

Reasoning VLA models that generate chain-of-thought before actions may be vulnerable to targeted behavior hijacking; prior adversarial attacks on VLAs are mostly untargeted and focus on vanilla VLAs without CoT.

Approach

Optimize a physical adversarial patch with a CoT cross-entropy hijacking loss plus an action loss (and content/TV stealthiness terms) so the VLA's intermediate reasoning and downstream actions follow an attacker-chosen target, while the user instruction stays benign.

Key results

• TRAP achieves 52.54% average ASR across MolmoAct, InstructVLA, and GraspVLA (75.84% on GraspVLA, 33.71% on InstructVLA), versus 5.48% for the Action Attack baseline.
• In real-world object-occluded deployment with GraspVLA, the printed PGD patch reached 38.0% ASR (19/50) and the DIP-optimized patch 34.0% (17/50).
• Lightweight consistency-check defenses achieve roughly 86-92% attack reject rates, approaching a GPT-5-based checker at much lower latency.

Surprising findings

• CoT-only hijacking fails on InstructVLA (4.03% ASR) because its action outputs collapse into repetitive behaviors even when the target CoT is generated, requiring the action loss.
• Paraphrased instructions drastically reduce transfer ASR on InstructVLA (67.4% to 25.1%) while MolmoAct remains robust.

Limitations

• Evaluation limited to short-horizon pick-and-place primitives since current reasoning VLAs struggle with long-horizon tasks.
• Transferability across fine-tuned checkpoints is partial (MolmoAct 48.05% to 18.39%; InstructVLA 33.10% to 9.20%), and cross-architecture transfer is not established.
• Occlusion sensitivity: attack degrades sharply with larger occlusion ratios, especially center occlusion.

Experimental setup

Datasets: SimplerEnv LIBERO offline clean rollouts from victim VLAs

Benchmarks: SimplerEnv LIBERO

Metrics: attack success rate trajectory hijack score (DTW-based)

Baselines: Random Noise Action Attack (TMA) TRAP-CoT-only

Builds on: Projected Gradient Descent Expectation over Transformation Deep Image Prior SimplerEnv LIBERO

Closest papers by meaning

• BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization (NeurIPS 2025 · similarity 0.90)
• CoT-VLA: Visual Chain-of-Thought Reasoning for Vision-Language-Action Models (CVPR 2025 · similarity 0.89)
• Taming CoT Obfuscation in VLMs: From Mechanistic Evidence to Activation-Level Enforcement (NeurIPS 2026 · similarity 0.87)
• VLA-Corrector: Lightweight Detect-and-Correct Inference for Adaptive Action Horizon (NeurIPS 2026 · similarity 0.87)
• CoT-Guard: Small Models for Strong Monitoring (NeurIPS 2026 · similarity 0.87)
• VLA-ATTC: Adaptive Test-Time Compute for VLA Models with Relative Action Critic Model (ICML 2026 · similarity 0.87)