Vision-Language-Action models have become a powerful paradigm for general-purpose robot manipulation, but moving them into the real world exposes a vulnerability to minor environmental perturbations.
FLARE is an optimized physical spotlight attack that exploits this through targeted illumination, dropping baseline task success rates to zero without any access to model internals. Adversarial training is the standard countermeasure — but it hides a pitfall. Naive data augmentation conditions VLA models to treat color as noise, collapsing their perception into a purely shape-biased processor. A diagnostic grayscale evaluation exposes the damage: the defended model keeps high success rates on grayscale inputs while its success on benign, color-dependent tasks falls to at most 47.5%, below the undefended baseline.
ChromaGuard is a chroma-preserving adversarial training method that closes the gap. On a physical 6-DoF robotic platform it reaches 97.5% success on benign color-dependent tasks and 92.5% under attack.