---
title: 'FreezeVLA: Adversarial Inaction in VLA Models'
url: https://www.emergentmind.com/topics/freezevla
type: topic
---

# FreezeVLA: Adversarial Inaction in VLA Models

Searching arXiv for FreezeVLA and closely related VLA safety papers.
FreezeVLA is an adversarial attack framework for Vision-Language-Action (VLA) models that targets a specific embodied failure mode: persistent inaction. Rather than redirecting a robot toward an incorrect trajectory, it crafts an adversarial image that induces the model to output a model-specific inaction token, causing the robot to freeze and to ignore subsequent user instructions [2509.19870]. Within the broader VLA safety literature, FreezeVLA is treated as a canonical example of an inference-time visual adversarial attack whose defining consequence is “action-freezing” or “robot paralysis,” produced when a representational shift severs the perception-action link [2604.23775]. The framework is situated at the intersection of multimodal adversarial robustness, embodied control safety, and long-horizon policy reliability, and is notable for emphasizing that non-action can be as safety-critical as overtly incorrect action in deployed robotic systems [2509.19870].

## 1. Conceptualization and threat model

FreezeVLA formalizes an attack in which an adversary perturbs the visual observation presented to a deployed VLA model so that the resulting policy ceases meaningful control and emits a freeze-equivalent action across prompts [2509.19870]. The attack channel is visual only, and the perturbation is constrained in \(L_\infty\) norm:
\[
\|x' - x\|_\infty \le \epsilon.
\]
The paper assumes a white-box attack on the VLA model and black-box access to the user prompt: the attacker has access to model architecture and parameters and can differentiate through the image input, but cannot alter or control the textual instruction at inference time [2509.19870].

The attack target is not a universal zero action in a continuous control sense, but a model-specific inaction token. For SpatialVLA and \(\pi_0\), freezing corresponds to an \(\textless eos\textgreater\) token that terminates an action chunk; for OpenVLA, freezing corresponds to a “do nothing” token. The authors introduce \(\textless freeze\textgreater\) as a convenience term for whichever token enforces inaction in the target model [2509.19870]. This framing is important because it defines freezing operationally at the policy interface rather than by a fixed control-space signature.

The VLA safety survey places FreezeVLA within inference-time attacks, specifically under visual perturbations, and characterizes the induced failure as “robot paralysis” caused by “visual perturbations causing action freezing” [2604.23775]. In the survey’s general formulation, a VLA policy is modeled as
\[
\pi_\theta(a_t \mid o_{\le t}, l) \approx p(a_t \mid v_{\le t}, s_{\le t}, l),
\]
where \(v_t\) denotes visual input, \(s_t\) proprioceptive state, \(l\) the instruction, and \(a_t\) the action [2604.23775]. A freezing attack targets the visual channel \(v_t\) at test time.

The survey further distinguishes freezing attacks from neighboring threat classes by failure mode. Semantic jailbreaks manipulate language to induce unsafe compliance; generic visual adversarial attacks cause misperception or trajectory deviation; cross-modal attacks create semantic mismatch across modalities. FreezeVLA, by contrast, is defined by non-responsiveness: the model stops acting meaningfully because the perception-action link is broken [2604.23775]. This suggests that FreezeVLA should be understood not merely as another visual attack instance, but as a specialized subclass of inference-time adversarial robustness failure in embodied policies.

## 2. Technical formulation and optimization procedure

FreezeVLA’s core technical contribution is a bi-level min-max optimization framework that jointly searches over hard prompt variants and adversarial images, with the explicit goal of making a single adversarial image transferable across multiple prompts [2509.19870]. The model is denoted \(\mathcal{F}\), parameterized by \(\theta\), and induces a next-action-token distribution
\[
p(\cdot \mid x, p; \theta).
\]

A preliminary targeted objective is written as
\[
x' = \arg\min_{\| x' - x \|_{\infty} \leq \epsilon} -\log(\Pr(t_{n+1:n+m} \mid x, t_{1:n}; \theta)),
\]
with FreezeVLA specializing the target tokens to the freeze token so that \(\mathcal{F}(x', p)\) predicts \(\textless freeze\textgreater\) across prompts [2509.19870]. The survey contextualizes this within a more general VLA visual-adversarial objective,
\[
\delta^* = \arg\max_{\|\delta\|_p \le \epsilon} \mathcal{D}\big(\pi_\theta(o+\delta, p), a^*\big),
\]
where \(\mathcal{D}\) measures divergence between predicted and desired action behavior [2604.23775]. For FreezeVLA, the implied special case is maximization of action degradation until the controller enters a freeze or paralysis regime rather than a generic off-nominal trajectory.

The inner level of FreezeVLA performs adversarial prompt maximization. Starting from a reference prompt set \(\mathcal{P}\), prompts are represented as
\[
p = [t_1,t_2,\dots,t_n] \in \mathcal{P}.
\]
The method identifies an impactful token via the gradient of the freezing loss,
\[
t_i \leftarrow \underset{t_i}{\argmax} \nabla_{t_i} \mathcal{L}(\mathcal{F}(x', t_{1:n}), \textless freeze\textgreater),
\]
then greedily replaces that token with a synonym \(t_i^\star\). The replacement is accepted if it makes freezing less likely:
\[
\Pr(\textless freeze\textgreater \mid x', p^\star; \theta ) \leq \Pr(\textless freeze\textgreater \mid x', p; \theta ).
\]
This yields a set of hard prompts \(\mathcal{P}^\star = \{p_1^\star,\dots,p_N^\star\}\) that are relatively resistant to the current adversarial image [2509.19870].

The outer level updates the image against those hard prompts using a PGD-style sign-gradient step:
\[
x'_{n+1} = x'_{n} + \alpha\sign\left(\sum_{p^\star \in \mathcal{P}^\star} \nabla_{x_n'} L(\mathcal{F}(x_n', p^\star), \textless freeze\textgreater)\right),
\]
with clipping to enforce the \(L_\infty\) budget,
\[
x' \leftarrow \text{Clip}_{x,\epsilon}\left(x' + \alpha \cdot \text{sign}(g_x)\right),
\qquad
g_x = \sum_{p^\star \in \mathcal{P}^\star} \nabla_x L(\mathcal{F}(x', p^\star), \textless freeze\textgreater).
\]
The paper summarizes the joint procedure as
\[
\min_{\| x' - x \|_{\infty} \leq \epsilon} \; \max_{p^\star \in \text{Syn}(p)} \sum_{p^\star \in \mathcal{P}^\star} L (\mathcal{F}(x', p^\star), \textless freeze\textgreater),
\]
while also noting, through its algorithmic description, that the intended semantics are: inner prompt search reduces freeze likelihood, outer image optimization increases it [2509.19870]. The notation in the printed objective is not fully self-consistent, but the optimization logic is explicit.

Reference prompts number \(|\mathcal P| = 20\), with prompts sampled from other datasets or generated with OpenAI o3 in the “FreezeVLA + GPT” variant. Prompt optimization uses greedy WordNet synonym replacement, changing one word per prompt per inner iteration. The reported main hyperparameters are \(M=10\) inner prompt iterations, \(K=100\) or \(T=100\) image iterations, step size \(\alpha = 1/255\), and perturbation budget \(\epsilon = 4/255\) [2509.19870]. The paper does not present an adaptive stopping rule; the optimization runs for a fixed number of iterations.

## 3. Models, benchmarks, and empirical results

FreezeVLA is evaluated on three open-source VLA models—SpatialVLA, OpenVLA, and \(\pi_0\)—across four LIBERO manipulation benchmarks: LIBERO-10, LIBERO-Goal, LIBERO-Object, and LIBERO-Spatial [2509.19870]. The models differ in action representation and prompting conventions: OpenVLA uses a discrete action decoder without action chunking and a dialogue-style `In:`/`Out:` prompt template; SpatialVLA uses action chunking with a discrete action decoder; \(\pi_0\) uses action chunking with continuous diffusion policy heads and a short task string prompt [2509.19870].

The evaluation protocol perturbs the visual observation image, optimizing the adversarial image using a set of reference prompts and then testing that same image under target or unseen prompts to assess cross-prompt transferability [2509.19870]. The main reported metric is Attack Success Rate (ASR), defined in words as “the percentage of adversarial images that induce a consistent paralysis state” [2509.19870]. The survey separately notes ASR as a standard VLA attack metric:
\[
\text{ASR} = \frac{|\{i : \text{attack } i \text{ succeeds}\}|}{|\mathcal{A}_{\text{attack}}|},
\]
and highlights temporal persistence as especially relevant for attack effects that extend over time [2604.23775].

The main ASR results at \(\epsilon = 4/255\) are summarized below.

| Model | FreezeVLA | FreezeVLA + GPT |
|---|---:|---:|
| SpatialVLA | 65.1 | 73.3 |
| OpenVLA | 93.2 | 95.4 |
| \(\pi_0\) | 54.2 | 59.8 |

Per-dataset results for FreezeVLA + GPT are also reported. For SpatialVLA, ASR is 66.0 on LIBERO-10, 82.8 on LIBERO-Goal, 63.7 on LIBERO-Object, and 80.8 on LIBERO-Spatial. For OpenVLA, ASR is 92.2, 95.7, 98.4, and 95.3, respectively. For \(\pi_0\), ASR is 70.0, 62.9, 65.2, and 41.1 [2509.19870]. The abstract reports an average ASR of 76.2% across settings [2509.19870].

The paper compares FreezeVLA against Random Noise, single-prompt PGD, Multi-Prompt, and Multi-Prompt + GPT baselines. Random noise is ineffective; single-prompt PGD performs poorly for prompt transfer; optimization over multiple prompts already improves performance substantially; GPT-generated prompt diversity strengthens transfer further; FreezeVLA is best overall with GPT prompt generation and is especially strong on SpatialVLA and \(\pi_0\) [2509.19870]. A notable result is that OpenVLA is already highly vulnerable under the simpler Multi-Prompt baseline, with 92.0 average ASR, suggesting pronounced susceptibility to cross-prompt inaction attacks [2509.19870].

Ablations reinforce the cross-prompt-transfer premise. On SpatialVLA, increasing the number of reference prompts from 1 to 20 raises average ASR from 20.0% to 65.1% for FreezeVLA and from 22.0% to 73.3% for FreezeVLA + GPT, with the strongest gains up to about 10 prompts [2509.19870]. Perturbation-budget experiments on SpatialVLA show that ASR is nearly 0% at \(1/255\), becomes substantial at \(4/255\), and exceeds 95% average ASR at \(8/255\) and \(16/255\) for both FreezeVLA and FreezeVLA + GPT [2509.19870]. Image-step ablations from 50 to 300 and prompt-step ablations from 5 to 30 indicate that image iterations substantially improve ASR up to around 200, while prompt iterations help with diminishing returns after about 15–20 [2509.19870].

The experiments are simulation-only and were run on an HPC cluster with \(32 \times \text{NVIDIA A800-SXM4-80GB GPUs}\), indicating nontrivial computational cost for the joint prompt-image optimization [2509.19870].

## 4. Mechanism of action-freezing and embodied safety significance

FreezeVLA’s central claim is that adversarial images can push VLA systems into a persistent paralysis regime in which the robot repeatedly emits end-of-action or no-op behavior rather than task-relevant actions [2509.19870]. The survey frames this mechanism at a higher level: adversarial images induce cross-modal mismatch and push the predicted trajectory far from the optimal distribution; this can cause the model’s “decision-making confidence collapse,” culminating in the “action-freezing” phenomenon defined by FreezeVLA, where “the representational shift severs the perception-action link, causing the model to ignore subsequent instructions and resulting in total operational paralysis” [2604.23775].

This characterization has several implications. First, the failure is persistent rather than momentary. FreezeVLA emphasizes that inaction is stable: if the attack causes a wrong motion, the scene geometry may change and invalidate the perturbation, whereas if the robot freezes, the viewpoint and scene remain largely fixed, allowing the effect to persist [2509.19870]. Second, the attack suppresses responsiveness across prompt variations, so the language input no longer meaningfully conditions action generation once the adversarial image dominates the model’s multimodal processing [2509.19870]. Third, because VLAs operate in closed loop or chunked control, a persistent corruption of observations can compromise the entire trajectory rather than a single action step [2604.23775].

The safety significance follows from embodiment. FreezeVLA explicitly argues that “doing nothing” can be catastrophic in robotics, citing halted manufacturing, interrupted surgical procedures, collisions due to sudden stops in autonomous driving, and delayed intervention in time-critical settings [2509.19870]. The survey generalizes the same point: embodiment introduces irreversible physical consequences, inference-time failures are safety-critical under real-time latency constraints, and long-horizon errors compound over trajectories [2604.23775]. A freeze can therefore constitute more than denial of service; it can leave the robot stalled in a dangerous intermediate state, unable to recover autonomously.

This also explains why FreezeVLA is not reducible to text-only LLM safety concerns. The survey explicitly distinguishes VLA safety from text-only safety and classical robotic safety, emphasizing the multimodal attack surface, physical consequences, and control-loop dynamics specific to embodied policies [2604.23775]. FreezeVLA exemplifies that distinction: the attack is visually induced, action-level, prompt-transferable, and physically consequential.

## 5. Position within VLA safety taxonomy and related work

In the survey “Vision-Language-Action Safety: Threats, Challenges, Evaluations, and Mechanisms,” FreezeVLA is explicitly listed in the inference-time attack table as a 2025 “Visual Adv.” attack with the effect “Robot Paralysis” and the description “Visual perturbations causing action freezing” [2604.23775]. The survey treats FreezeVLA as the canonical example of “freezing attacks” or “action-freezing” within inference-time visual adversarial robustness. It is firmly categorized as inference-time rather than training-time, visual rather than language-side or proprioceptive, digital rather than explicitly physically realized, and trajectory-relevant because the paralysis can persist across subsequent timesteps and instructions [2604.23775].

This placement distinguishes FreezeVLA from several adjacent attack families. Training-time attacks such as BadVLA, DropVLA, GoBA, State Backdoor, SilentDrift, and Clean-Action implant failures into the model during learning; FreezeVLA requires no poisoning of data or weights and instead attacks the deployed system through observation perturbation [2604.23775]. Semantic jailbreaks manipulate language to bypass alignment and induce unsafe compliance; FreezeVLA attacks the visual channel and induces non-compliance through paralysis [2604.23775; 2509.19870]. Generic visual perturbation attacks aim at misexecution or arbitrary degradation; FreezeVLA specifically targets a collapse into no-action [2604.23775].

The survey also contextualizes FreezeVLA with two neighboring lines of work. “Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Robotics” is cited for the finding that “small adversarial patches placed within the camera’s field of view can effectively compromise task execution in both simulated and physical environments, with task success rate reductions of up to 100%,” illustrating the broader vulnerability of VLA control to visual perturbations [2604.23775]. “VLA-Fool” is cited for cross-modal semantic mismatch and trajectory corruption, which the survey uses to motivate the representational-drift interpretation of freezing [2604.23775]. FreezeVLA differs from both by singling out paralysis as the target control-collapse outcome.

A possible misconception is that FreezeVLA refers to freezing model parameters or selectively freezing parts of a multimodal backbone for efficiency. That usage appears in unrelated literature on training-free acceleration or selective computation freezing, such as visual-token freezing in multimodal LLMs or frozen-model VLA wrappers [2504.00502; 2607.06370; 2607.08448]. In the VLA safety literature, however, FreezeVLA specifically denotes action-freezing attacks against deployed VLA models [2509.19870; 2604.23775]. The shared lexical root “freeze” thus spans distinct research threads—robustness attacks, computational freezing, and frozen-backbone systems—but FreezeVLA as a named method is the adversarial paralysis framework.

## 6. Limitations, defenses, and open problems

FreezeVLA does not propose a concrete defense. Its defense discussion is primarily a warning that freezing behavior may evade standard failure detectors because it can resemble benign standby or task completion; SAFE and AdvQDet are mentioned only in passing [2509.19870]. The paper explicitly acknowledges two major limitations: the threat model is white-box, and the evaluation is simulation-only on LIBERO benchmarks [2509.19870]. The semantic drift visible in some optimized prompts also suggests that the greedy synonym-search inner loop broadens prompt coverage at the cost of semantic coherence in later iterations [2509.19870].

The survey provides a broader defensive context relevant to FreezeVLA. Runtime observation interventions such as BYOVLA use heuristic masking to filter visual distractors and improve visual robustness; this is among the most directly relevant classes of mitigation for visual freezing attacks [2604.23775]. Runtime monitoring systems such as SAFE, REFLECT, FailSafe, and lightweight semantic monitors like Causal Scene Narration are discussed as mechanisms for detecting anomalous hidden-state trajectories, degenerate action streams, or mismatches between execution and instruction-conditioned intent [2604.23775]. Decision-layer guardrails such as AEGIS and VLSA compute safe actions from raw VLA outputs:
\[
a_{\text{safe}} = \arg\min_{a \in \Omega_{\text{safe}}} \|a - u_{\text{vla}}\|^2,
\]
which may mitigate hazardous outputs, though they do not directly repair perception collapse [2604.23775].

The survey also highlights physical fail-safes and rollback mechanisms, including ATACOM-style projection, Safe-VLN collision avoidance, Affordance Field Intervention, CompliantVLA, and low-level compliance. Affordance Field Intervention is especially relevant because it “rolls back to a safe state upon detecting a physical stall,” which is conceptually close to freeze detection and recovery [2604.23775]. Confidence calibration is another cited direction, using expected calibration error
\[
\text{ECE} = \sum_{m=1}^{M} \frac{|B_m|}{N} \left| \text{acc}(B_m) - \text{conf}(B_m) \right|,
\]
with the implication that a well-calibrated VLA could recognize unreliable perception and defer to safer fallback controllers [2604.23775].

Several open problems identified in the survey apply directly to FreezeVLA. Certified robustness for embodied trajectories remains unresolved because perturbations are cross-modal, sequential, trajectory-level, and constrained by real-time control [2604.23775]. This suggests that robustness guarantees against per-frame perturbations are insufficient for action-freezing, where persistence over time is the salient risk. Physically realizable defenses remain underdeveloped, raising the question of whether the same freeze phenomenon can be induced by printed patterns, lighting changes, or scene manipulations rather than digital perturbations alone [2604.23775]. Standardized evaluation is another gap: the survey notes fragmentation across benchmarks and simulation-dominant testing, while FreezeVLA itself does not define dedicated metrics such as freeze duration or recovery latency [2604.23775]. A plausible implication is that future work will need explicit temporal metrics for paralysis persistence, recovery behavior, and downstream safety impact, in addition to ASR and task-level success.

Taken together, FreezeVLA established action-freezing as a distinct adversarial threat to VLA systems, and the subsequent survey consolidated it as a named category within inference-time visual attacks [2509.19870; 2604.23775]. Its lasting significance lies in making persistent inaction an explicit safety object for embodied AI, thereby broadening adversarial robustness analysis from “wrong action” to “failure to act” in systems whose outputs have immediate physical consequences.

Source: https://www.emergentmind.com/topics/freezevla