Test-time Adversarial Takeover: A Real-time Hijacking Interface against Robotic Diffusion Policies

Abstract: Diffusion-based action generation has become a foundational component of embodied AI, but its reliance on visual conditioning leaves deployed visuomotor policies vulnerable to adversarial manipulation. Most prior attacks focus on disruption: they perturb the observation stream to reduce task success or induce erratic behavior. We study a stronger threat, Test-time Adversarial Takeover (TAKO), in which an attacker obtains a real-time steering interface over a frozen robot policy and turns it into a remotely piloted instrument. TAKO learns a small vocabulary of reusable universal patches through differentiable diffusion inference; at test time, the attacker switches among these patches in the camera stream to compose attacker-chosen trajectories. This works because the perturbation acts on the visual conditioning pathway, where the induced bias can persist through iterative generative inference. We further show that the natural targeted baseline, target-policy matching, fails because the victim policy cannot reliably supervise itself on out-of-distribution target shifts. Across four tasks (2D manipulation, simulated aerial delivery, simulated ground navigation, and physical-world ground navigation), two visual encoders (ResNet-18 and EfficientNet-B0 + Transformer), and three generative inference families (DDPM, DDIM, and flow matching), human operators achieve 100\% takeover success on attacker-defined objectives in every evaluated setting. The project page is available at https://tako-attack.github.io.

• The paper introduces TAKO, an offline-to-online attack that optimizes universal directional patches and switches among them at test time to steer frozen diffusion policies through closed-loop human control.
• TAKO achieved 40/40 takeover success on PushT, DeliverDrone, SimNav, and physical RealNav, while the target-policy-matching baseline achieved 0/40 across all evaluated tasks.
• The findings show that visual-conditioning attacks persist through iterative denoising, while practical deployment still depends on white-box optimization and digital patch injection, leaving physical and black-box attacks open.

Overview and threat model

This paper introduces Test-time Adversarial TakeOver (TAKO), an attack paradigm against diffusion-based visuomotor robot policies that departs from the disruption objectives that dominate prior adversarial robotics work. Rather than perturbing observations to reduce task success, TAKO gives a human attacker sustained, real-time steering authority over a frozen policy: a small vocabulary of pre-optimized universal adversarial patches is composited into the camera stream at test time, and switching among patches composes arbitrary attacker-defined trajectories. The authors frame this as a shift from a safety problem (accidental failure) to a security problem (unauthorized takeover) (2606.10371).

The threat model assumes white-box access to the policy for offline patch optimization and the ability to overlay a fixed-shape patch at a fixed image location on every frame at inference time. The perturbation is bounded in $L_\infty$ norm by $\varepsilon = 64/255$, proprioceptive inputs are unperturbed, and model weights are frozen. Once disengaged, the policy resumes its trained behavior on the clean stream. This is a strong set of assumptions; the paper concedes explicitly that physical-patch realization and black-box variants remain open.

Why target-policy matching fails

The natural baseline for targeted attacks is Target-Policy Matching (TPM): query the frozen victim policy under goal-shifted scenes to obtain reference actions $\bar{a}^{\,c}$, then optimize a patch minimizing MSE between patched and reference actions. The paper shows this fails structurally, not as a hyperparameter issue. Two failure modes are isolated experimentally:

• OOD-supervision pathology: running the frozen victim policy without any patch in goal-shifted environments yields 0/40 task success; the policy's actions across different shifted targets are nearly identical, indicating goal-locking. The MSE loss converges, but the supervision itself carries no directional signal.
• Accumulative drift: even granting TPM perfect direction-specific patches, open-loop deployment of a static reference accumulates off-axis drift. With the same patch vocabulary, closed-loop operator control keeps drift low while open-loop drift grows rapidly over 150 steps (per-direction paired Wilcoxon $p < 0.02$; combined $p = 1.4 \times 10^{-9}$).

The implication is that the conventional targeted-attack template is mismatched to deployed generative policies: it requires the victim to supervise itself on out-of-distribution counterfactuals and cannot correct drift without online feedback. TPM achieves 0/40 ASR on all four tasks.

Method: offline vocabulary, online composition

TAKO replaces reference matching with a two-stage protocol. In Stage 1, each command $c$ (e.g., forward/backward/left/right) is associated with a universal patch optimized by backpropagating through the full differentiable inference chain — vision encoder, conditioning, and unrolled sampler (DDIM for DDPM-trained policies, forward-Euler for flow matching) — using a directional loss that maximizes signed displacement along one action axis, averaged over an observation pool sampled from the training distribution. Because the objective only requires a consistent mean bias rather than trajectory-level supervision, it never invokes the policy on OOD scenes. Optimization is cheap: roughly 10 minutes per patch on a single A40 GPU.

In Stage 2, the attacker selects a vocabulary entry online at each replanning step; the patched observation is fed to the policy, which generates smooth executable action chunks. Two properties distinguish this from one-shot perturbations: composability (the realized trajectory is determined by the command sequence) and closed-loop control (the operator chooses commands from the current state, so per-patch drift does not accumulate). The mechanism underlying the attack is architectural: because the perturbation acts on the visual conditioning pathway, iterative generative denoising steers toward rather than corrects the induced bias.

Experimental results

The evaluation spans four tasks — PushT (2D manipulation), DeliverDrone (Gazebo quadrotor delivery), SimNav (AI2-THOR first-person navigation with velocity actions), and RealNav (physical iRobot Create 3 navigation) — covering two visual encoders (ResNet-18; EfficientNet-B0 + Transformer), three inference families (DDPM, DDIM, flow matching), and both position-style and velocity-style action parameterizations.

Task	Clean performance	TPM ASR	TAKO ASR (human)
PushT	10/10	0/40	40/40
DeliverDrone	10/10	0/40	40/40
SimNav	20/20	0/40	40/40
RealNav	20/20	0/40	40/40

Four operators each ran 10 trials per task against targets visible only to them, steering via keyboard-bound patches. The headline claim is strong: 100% takeover success in every evaluated setting, including the physical-world RealNav platform with real sensor latency, lighting variation, and wireless ROS 2 communication. Offline directional success rates range from about 66% (RealNav under DDPM/DDIM) to 100% (DeliverDrone under flow matching); SimNav's lower single-step sign agreement reflects a metric–parameterization mismatch for velocity actions, where consistent small biases accumulate into reliable steering over the deployment horizon.

Ablations on PushT identify the dominant factors. Patch size matters: a $32\times32$ patch (11% of image area) reaches 94% directional success, and even $16\times16$ retains 79%, though reliable task completion online requires $48\times48$ (25% area). The perturbation budget saturates above $\varepsilon = 64/255$. Most notably, increasing DDIM steps from 3 to 20 leaves the directional shift essentially flat (140.4 → 151.7 px), directly supporting the claim that the denoising chain does not attenuate adversarial bias introduced through conditioning. Patch placement matters moderately (center/right-edge/bottom-right exceed 93% success; top-edge placements are weaker), while agent-position conditioning and EOT over diffusion seeds have negligible effect.

Limitations and open questions

The paper is explicit about its boundaries. All experiments assume white-box access for offline optimization and digital injection into the camera stream; whether takeover survives physical patch realization, viewpoint variation, or black-box optimization is left open. The vocabulary is limited to four cardinal directions tailored to planar navigation tasks, and expressiveness beyond this regime is not characterized. Online human trials are inherently non-deterministic, and the code release is deferred past review. No defenses are evaluated; the authors suggest input-space anomaly detection, certified robustness on the visual encoder, and randomized conditioning pathways as plausible directions but provide no evidence for any of them. Whether the attack transfers to VLA-scale policies or to tasks where action primitives cannot be decomposed into a small directional vocabulary remains unanswered.

Conclusion

This paper reframes adversarial risk for diffusion-based robot policies from disruption to sustained takeover. Its central empirical result — 40/40 interactive takeover success across four tasks, two encoders, three inference families, and a physical platform, against a baseline that fails uniformly — demonstrates that adversarial bias injected through visual conditioning persists through generative inference strongly enough to support operator-controlled steering. The structural diagnosis, that target-policy matching fails because frozen policies cannot supervise themselves on OOD shifts and open-loop references accumulate drift, is as consequential as the attack itself, since it indicates that conventional targeted-attack evaluations may substantially understate the achievable adversary capability.