VLA-Hijack: A Transferable Patch Attack against Vision-Language-Action Models via Visual Proprioception Hijacking

While Vision-Language-Action (VLA) models have emergedas powerful generalist policies, their severe vulnerability to adversarialpatches significantly hinders their deployment in safety-critical domains.Moreover, existing patch attacks primarily focus on white-box settings,heavily overfitting to the specific action output space of the target model,which results in poor cross-architecture transferability. To overcome thislimitation, we propose VLA-Hijack, a unified adversarial framework thatbreaks the transferability bottleneck by exploiting a fundamental vulner-ability identified in this work: before planning any motion, a VLA modelmust first use visual information to locate its own robotic arm withinthe environment. Targeting this shared visual self-localization process,our approach concurrently optimizes Attention-Guided ProprioceptiveSuppression to inhibit the real robotic arm’s features, and MultimodalProprioceptive Injection to establish the patch as a surrogate "phantomembodiment". By alternating between semantic concept anchoring andvisual prototype projection, VLA-Hijack effectively severs the semanticrelationship between the agent’s true embodiment and its control pol-icy. Extensive experiments across diverse architectures (OpenVLA, Uni-VLA, and CronusVLA) demonstrate that VLA-Hijack achieves superioroptimization efficiency in white-box settings and sets a new SOTA forcross-architecture and cross-domain black-box transferability.