Research map / Vision-language and multimodal / Robot action and navigation

RedVLA: Physical Red Teaming for Vision-Language-Action Models

NeurIPS 2026 · Vision-language and multimodal › Robot action and navigation · approach: Vision-language-action foundation models · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes RedVLA, a physical red-teaming framework that injects a risk object into LIBERO scenes at critical end-effector interaction regions and refines its position with gradient-free trajectory-guided updates to elicit unsafe VLA behaviors, plus a lightweight LSTM guard (SimpleVLA-Guard) trained on the elicited data.

Problem

VLA models risk unpredictable, irreversible physical harm, yet there is no effective way to proactively detect physical safety risks before deployment; existing red teaming focuses on linguistic or visual perturbations rather than physical risk objects.

Approach

Inject task-feasible physical risk objects into benign scenes at interaction regions mined from benign trajectories, then iteratively move the risk object's position toward trajectory anchor points (collision or grasp events) with backtracking validity checks, under a state/cumulative/conditional safety cost taxonomy.

Key results

• RedVLA achieves average ASR of 64.9% (OpenVLA) to 95.5% (pi0.5) across six VLAs, with peak 95.5% within 10 optimization iterations.
• SimpleVLA-Guard reduces online ASR from 90.9% to 31.4% on seen tasks and from 98.3% to 46.7% on unseen tasks, with Benign SR drop of 4.08% and 10.00%.
• Real-world Franka validation on pi0 and pi0.5 yields ASR above 80% over 10 trials per task.

Surprising findings

• Stronger VLA models (higher benign success) show higher attack success rates, a performance-safety trade-off across three model families.
• Most unsafe rollouts occur during task attempts rather than from model collapse.

Limitations

• Depends on predefined safety predicates, risk objects, and violation types, limiting diversity.
• Requires VLAs with reasonably strong benign performance; less applicable to immature models or other embodiments.
• Evaluated mainly in simulation on LIBERO with a limited real-world validation.

Experimental setup

Datasets: LIBERO LIBERO-Long

Benchmarks: LIBERO RedVLA risk scenario suites

Metrics: ASR ASR@K SR Benign SR PRC-AUC Recall@FPR10

Baselines: OpenVLA OpenVLA-OFT VLA-Adapter VLA-Adapter-Pro pi0 pi0.5

Builds on: LIBERO BDDL Functional Conformal Prediction

Closest papers by meaning

• ReaLM: A Unified Red-Teaming Benchmark for Physical-World VLMs (NeurIPS 2026 · similarity 0.91)
• SafeVLA: Towards Safety Alignment of Vision-Language-Action Model via Constrained Learning (NeurIPS 2025 · similarity 0.90)
• TreeTeaming: Autonomous Red-Teaming of Vision-Language Models via Hierarchical Strategy Exploration (CVPR 2026 · similarity 0.89)
• TRUST-VLM: Thorough Red-Teaming for Uncovering Safety Threats in Vision-Language Models (ICML 2025 · similarity 0.89)
• DiveR-CT: Diversity-enhanced Red Teaming Large Language Model Assistants with Relaxing Constraints (AAAI 2025 · similarity 0.87)
• BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization (NeurIPS 2025 · similarity 0.87)