Recoleta
GitHub
Source note

Capability and Robustness Cannot Both Be Free: An Information-Theoretic Bound for Vision-Language-Action Models

Authors
Jianwei Tai
Source
arXiv
Published
Collection
Embodied AI
Vision Language ActionRobot Policy RobustnessInformation TheoryAdversarial AttacksOpenvla
Open arXivMarkdown source

Summary

The paper claims a general information-theoretic upper bound on the sum of VLA policy capability and adversarial robustness. It targets robot action policies such as OpenVLA, including tokenized, continuous, multi-step, and encoder-based variants.

Problem

  • VLA models can perform well on clean robot benchmarks while failing under small image perturbations; the excerpt cites OpenVLA-7B dropping from above 95% LIBERO success to under 5% under a 16/255 PGD attack.
  • Existing VLA attack and defense work reports empirical trade-offs, but it has not shown whether clean capability and attack robustness can both increase without a limit.
  • The issue matters because a VLA output is a physical robot action, so visual fragility can produce unsafe behavior instead of a wrong label.

Approach

  • The core bound is: capability plus robustness is at most task entropy plus attack channel capacity: I(A*; A_pi) + I(A_pi; A_tilde_pi) - I(A_pi; delta) <= H(A*) + I(X; X_tilde).
  • Capability means the mutual information between the policy action and the oracle action.
  • Robustness means how much information the clean action and attacked action share, with a debit for attack signal that leaks through the action output.
  • The proof uses two applications of the Data Processing Inequality: actions come from observations, and attacked actions come from perturbed observations, so the action channel cannot carry more information than the observation channel.
  • The paper extends the bound to quantized continuous actions, multi-step rollouts up to horizon T, and encoder-specific budgets using I(phi(X); phi(X_tilde)).

Results

  • The bound has zero reported violations across 320 validation cells covering Gaussian VLA proxies, OpenVLA-7B with PGD and Square attacks, all 4 LIBERO suites, horizons up to T=10, and both continuous-L1 regression and flow-matching action heads.
  • In the closed-form Gaussian proxy, analytical slack and MINE-estimated slack are non-negative in 252/252 cells; after grouping, 52/84 configurations show significant positive slack at alpha=0.05 after Holm-Bonferroni correction.
  • For OpenVLA on LIBERO, the excerpt reports H(A*) ≈ 26 nats and pixel/PCA I(X; X_tilde) ≈ 5,000 nats at epsilon=4/255.
  • The encoder-specific bound is reported as 28x to 68x tighter than the pixel-PCA bound across epsilon in {2,4,8,16}/255 on the 4 LIBERO suites.
  • At epsilon=8/255, the encoder-specific budget is reported as 86 to 142 nats on vanilla OpenVLA, with discretized capability around 7.5 nats and slack reduced from about 3.7-4.3e3 nats to 79 to 134 nats.
  • The paper claims three practical diagnostics computable from at most 200 samples: a roughly 5-minute pre-flight encoder ceiling, a defense-forensics shift signature, and a head-agnostic robustness ratio Rob_disc/Cap_disc.

Link