Capability and Robustness Cannot Both Be Free: An Information-Theoretic Bound for Vision-Language-Action Models
2026-05-25 • Cryptography and Security
Cryptography and SecurityMachine Learning
AI summaryⓘ
The authors study vision-language-action (VLA) models used in robots, which perform well normally but fail when small adversarial changes are made to their input. They prove a theoretical limit showing that improving a model's ability to act correctly and its robustness to such attacks cannot both be done indefinitely; there's a fixed 'budget' determined by the task and how much the input can be disturbed. This means defenses that improve robustness often reduce accuracy, and the authors quantify this trade-off. They verify their theoretical bound using experiments on real models and propose a new way to compare defenses based on how efficiently they use their 'budget'.
Vision-Language-Action modelsadversarial perturbationsmutual informationData Processing Inequalitypolicy robustnesstask entropyadversarial channel capacityOpenVLA-7BPGD attack
Authors
Jianwei Tai
Abstract
Vision-Language-Action (VLA) models are increasingly deployed on real robots, where each predicted action is executed and each failure carries a safety cost. They reach high success rates on clean inputs but collapse under small adversarial perturbations. A $16/255$ PGD attack on OpenVLA-7B drops LIBERO success from above $95\%$ to under $5\%$. Empirical defenses recover some robustness at a cost in clean accuracy, but the literature does not say whether the trade-off has a theoretical floor. We prove that it does. For any VLA policy with discrete actions, the sum of capability (mutual information between policy action and oracle action) and robustness (mutual information preserved under adversarial perturbation, net of trivial channel leakage) is upper-bounded by a policy-independent budget: task entropy plus adversarial channel capacity. The proof is two applications of the Data Processing Inequality plus MI non-negativity. The pixel-level bound is loose on current models ($\sim 10^3$ nats), but an encoder-specific corollary restricts the channel to the policy-relevant subspace, reducing the budget from $\sim 5{,}000$ to $\sim 31$ nats on OpenVLA; the policy already consumes $\sim 24\%$ of this tighter budget, leaving limited room for simultaneous robustness improvement. We validate the bound across $252$ closed-form Gaussian-VLA cells and $48$ OpenVLA-7B $\times$ LIBERO $\times$ PGD cells (zero violations). We propose encoder-specific slack as a normalized comparison axis for defense papers, and release all code, manifests, and results.