Trajectory-Level Redirection Attacks on Vision-Language-Action Models
Shows a prompt that still reads like the intended task can redirect a VLA's rollout to an attacker's target; an on-policy prompt search finds such near-benign prompts. Sim + hardware.揭示 VLA 的轨迹级漏洞：看起来仍在描述原任务的指令，可以把机器人执行结果引向攻击者指定的目标；作者用在线提示搜索找到这类近乎无害的提示。仿真与真机验证。
BibTeX
@misc{puthumanaillam2026trajectory,
title = {{Trajectory-Level Redirection Attacks on Vision-Language-Action Models}},
author = {Gokul Puthumanaillam and Vardhan Dongre and Pranay Thangeda and Hooshang Nayyeri and Dilek Hakkani-Tür and Melkior Ornik},
year = {2026},
eprint = {2606.12978},
archivePrefix = {arXiv},
primaryClass = {cs.RO},
url = {https://arxiv.org/abs/2606.12978},
}