On Robustness of Vision-Language-Action Model against Multi-Modal Perturbations
Authors: Jianing Guo
Zhenhong Wu
Chang Tu
Yiyao Ma
Xiangqi Kong
Zhiqian Liu
Jiaming Ji
Shuning Zhang
Yuanpei Chen
Kai Chen
Qi Dou
Yaodong Yang
Xianglong Liu
Huijie Zhao
Weifeng Lv
Simin Li
Venue: ICLR 2026 Poster (2026)
Keywords: Robustness
Vision-Language-Action Models
Primary area: foundation or frontier models, including LLMs
TL;DR: We evaluate and enhance the robustness of VLAs under 17 uncertainties in 4 modalities.

Abstract: In Vision–Language–Action (VLA) models, robustness to real-world perturbations is critical for deployment. Existing methods target simple visual disturbances, overlooking the broader multi-modal perturbations that arise in actions, instructions, environments, and observations. Here, we first evaluate the robustness of mainstream VLAs under 17 perturbations across four modalities. We find (1) actions as the most fragile modality, (2) Existing visual-robust VLA do not gain robustness in other modality, and (3) $\pi_0$ demonstrates superior robustness. To build multi-modal robust VLAs, we propose RobustVLA against perturbations in VLA inputs and outputs. For output robustness, we perform offline robust optimization against worst-case action noise that maximizes mismatch in flow matching objective. This can be seen as adversarial training, label smoothing, and outlier penalization. For input robustness, we enforce consistent actions across input variations that preserve task semantics. To account for multiple perturbations, we formulate robustness as a multi-armed bandit problem and apply an upper confidence bound algorithm to automatically identify the most harmful noise. Experiments on LIBERO demonstrate our RobustVLA delivers absolute gains over baselines of 12.6\% on the $\pi_0$ backbone and 10.4\% on the OpenVLA backbone across all 17 perturbations, achieving 50.6x faster inference than existing visual-robust BYOVLA that requires external LLMs, and a 10.4\% gain under mixed perturbations. On the real-world FR5 robot, under four types of multimodal perturbations, RobustVLA shows strong low-data performance, outperforming $\pi_0$ by $65.6\%$ success rate with 25 demonstrations. Even with abundant demos, our method still outperform $\pi_0$ by 30\% success rate. Code and demo videos available at https://github.com/gakakulicc/RobustVLA.

Published as a conference paper at ICLR 2026
ON ROBUSTNESS OF VISION-LANGUAGE-ACTION MODEL AGAINST MULTI-MODAL PERTURBATIONS
Jianing Guol-4, Zhenhong Wu', Chang Tu', Yiyao Ma', Xiangqi Kong', ZZiqian Liu',
Jiaming Jr², Shuning Zhang Yuanpei Chen Kai Chen', Qi Dou', Yaodong Yang?.
Xianglong Liu Huijie Zhao', Weifeng Lv!, Simin Lit.3'
'Beihang University, "Peking University, "The Chinese University of Hong Kong, "PKU-Psibot Lab, TTinghua University, 'Zhongguaneun Laboratory, "Hefei Comprehensive National Science Center
ABSTRACT
In Saiion-Langugge Action (VLA) models, robustmess to real-world perturbations is critical for deployment. Existing methods target simple visual disturbances, overlooking the broader multi-modal perturbations that arise in actions, instruc- tions, environments, and observations. Here, we first evaluate the robustness of mainstream VLAs under 17 perturbations across four modalities, We find (I) actions as the most fragile modality, (2) Existing visual-robust VLA do not gain robustness in other modality, and (3) To demonstrates superior robustness. To build molti- robust VLAs, we propose RobustVLA against perturbations in VLA inputs and outputs. For output robustness, we perform offline robust optimization against worst-case action noise that maximizes mismatch in flow matching objective. This can seen as adversarial training, label smoothing, and outlier penalization. For input robustness, enforce consistent actions across input variations that preserve task semantics. To account for multiple perturba- tions, formulate robustness upper confidence bound algorithm to automatically identify the most harmful noise. Experiments on LIBERO demonstrate our RobustVLA delivers absolute gains over baselines of 12.6% on the To backbone and 10.4% on the OpenVLA backbone across all 17 perturbations, achieving 50.6x faster inference than existing visual-robust BYOVLA that requires external LLMs, and a 10.4% gain under mixed perturbations. On the real-world FR5 robot, under four types of multimodal perturbations, RobustVLA shows strong low-data performance, outperforming by 65.6% success rate with 25 demonstrations. Even with abundant demos, our method still outperform To by 30% success rate. Code and demo videos available at http:://gttttoooooo/oaccaaaoo///
multi-armed bandit problem and apply
com
INTRODUCTION
Vision-Laagguge-Acttin (VLA) models are a class of robotic foundation models that enable flexible, general, and dexterous manipulation through vasion-e inputs (Zhong al. 2025 Sapkota
ct al.] 2025). Trained on diverse, internet-scale robot data, VLAs can perform cross- embodidd gencral-purpose control in real-world settings (Kim et al. 2025 Black et al. 2024 Bjorck al. 2025). Despite these advances, VLAs remain vulnerable to wide range of multi multi-modal uncertainties encountered practice, including those in observation (e.g., sensory noise, camera errors), action (e.g., sensorimotor noise, unexpected disturbances), environment (e.g., external forces, distracting objects), and language (e.g., synonymous or ambiguous instructions).
Recent work has begun to explore the robustness of VIAss, but efforts remain limited in scope. VLATest (Wang al. (025) primarily evaluates VLA robustness against visual perturbations, focusing uncertainties in environment transitions and observations. For enhancing robustness.
"Corresponding Author. E-mails: lisiminsimon buaa.cdu.cn.

---

Published as a conference paper at ICLR 2026
Robustness Evaluation
Robustness Enhancement
Evaluation: 17 Uncertainties in 4 modalities
Robust Against VLA Input
Robust Against Output
(b))
Learned Uy
A
Ohservation
Action
Environment
Instruction
Clean
Same Actions
Flow 2
Findings:
Brittle Modality Action
Perturbed Robust Ve Noise
Robust VLAs: Vision Robust Only
A
A
UCB
Backbone Robustness: ug LppeVLL
Perturbations
Selected
Perturbed Flow M
Figure 1: Framework of our paper. We evaluate VLA robustness under 17 uncertainties across modalities. Based on the findings, we enhance robustness against both VIA inputs and outputs.
BYOVLA (Hancock et al. 2025) mitigates irrelevant visual details by identifying, segmenting, and inpainting them using large vision-langure models, while GEVRM (Zhang al. (025) improves robustness to common visual corruptions such as color jitter through model-based planning. However, these methods are restricted to visual robustness, leaving their effectiveness against multi-modal uncertainties untested. Moreover, both approaches rely heavily on external large models, leading to substantial computational overhead.
To better understand the robustness of VLAs beyond visual uncertainties, as shown in Fig. I we evaluate and enhance the robustness of VLAS to multi-modal perturbations. We begin by evaluating the robustness of mainstream VLAs against 17 uncertainties across four modalities. Our findings are threefold: (1) action the most fragile modality, (2) existing visual-robust VLAs do not show improvements in other modalities, and (3) mo (Black et al. (024) demonstrates superior robustness, outperforming Open VLA (Kim et al.) 2025) and TASF (Pertsch et al.) 2025) by large margins. Based on these results, we recommend that robust VLAs focus robustness in all modalities and build on To backbone as a starting point.
Building on evaluation results, propose RobustVLA, which handles multi-modal uncertainties in both VLA inputs and outputs. RobustVLA is based on the xo backhone and generalizes naturally to other VLÁs. For robustness against VLA output, derive the worst-case action deviation from the flow-matching objective, then match the action head with both the original and worst-case action distributions. This process can be seen combination of flow matching with noisy action distributions, label smoothing, and outlier penalization. For robustness against VLA inputs, we ensure that the noise does not alter the semantics of the current state, so the optimal action remains invariant. We thus regularize the objective to maintain consistent output actions across diverse input perturbations. To balance various types of perturbations, we frame the problem as multi-armed bandit and employ the upper confidence bound (UCB) algorithm (Auer 2002) to select the most harmful perturbation for training. On LIBERO benchmark, RobustVLA achieves absolute gains of 12.6% on the mo backbone and 10.4% on the Open VLA backbone across 17 perturbations, being 50.6x faster than visual-robust B YOVLA that requires external LLMs, and achieving a 10.4% gain under mixed perturbations. In real-world deployment with four multimodal perturbations. RobustVLA performs strongly in the low-data regime, outperforming To by 65.6% with 25 demos, and still achieves 30% higher success rate than mo with 100 demos, where the performance of no saturates.
Contributions. Our contributions are twofold. First, we evaluate the robustness of VLAs under various multi-modal noise and offer suggestions for improving robustness of VLAs. Second, propose Robust VLA against input and output noise perturbations, which delivers robust gains across 4 modalities and 2 backbones in both simulation and real-world settings.
2 RELATED WORK
Vision LaahonnLnngagg--Aceee (VLA) Foundation Models. Vision-Languuge-Actinn (VLA) models serve as foundational systems for robotics, integrating vision, language, and control. Recent approaches can be categorized into two primary types. Autoregressive VLAs leverage large pretrained VLMs and generate discrete action tokens in autoregressive manner (Brohan et al. 2022 Zitkovich
jet al., [2023] O'Nllll et al., 2024 Kim et al. 2025) Pertsch et al.) 2025 QQu et al. 2025). These
action tokens are then decoded into lowelevel, executable actions. In contrast, diffusion-based VLAS
2

---

Published as a conference paper at ICLR 2026
generate continuous, high-freegg frggh-freuency,, multi-modal action distributions by outputting action sequences through a diffusion-based action head (Team et al.] 2024; Li et al., 2024 Black et al. 2024 Bjorck et al.. 2025). While these models excel in cenerrl-purposs embodied decision-making tasks, their robustness remains a significant concern. Existing research on robust VLAS primarily focus on visual input. For instance, VLATest (Wang et al., 2025) demonstrates that current VLAs vulnerable to various visual corruptions. To mitigate visual perturbations, BYOVLA (Hancock et al.) (0225) removes model-sensitive features in visual inputs using VLM-based segmentation and inpainting, while GEVRM (Zhang et al. 2025) addresses common visual corruptions, such as color jitter, through model-based planning. However, these robust VLA methods focus solely on visual inputs and fail to account for multi-modal uncertainties in real-world. Furthermore, all of these approaches rely extensive assess to external large models, leading to substantial computational overhead.
Robust Decision Making. Before the advent of VLAs, robust decision-making was primarily explored within the framework of RL, specifically through robust MDPs (Nilim & El Ghaoui 2005 Iyengar 2005). Uncertainties in these settings can arise from various components of MDPs, including environment transitions (Pinto et al. 2017 Mankowitz et al. 2019), actions (Tessler et al. 2019), states (Zhang et al. 2020; 2021), and rewards (Wang et al.) (020). In environments with simulators available, RL agents can learn robust policies through minimax optimization against worst-case adversaries. However, in the case of VLAs, only offline datasets are available, akin to the settings of behavior cloning (Schaal 1996) and offline RL (Levine et al. (020). Achieving robust decision-making in the absence an interactive environment more challenging, as policies under uncertainty may lead to actions outside the distribution of the original dataset, causing OOD transitions. Consequently, robustness is typically achieved in such settings for states (Shen al.
2020 Yang et al. 2022 Rigter et al. (2022) and environment transitions (Panaganti et al. 2023
Seo al.] 2024), with the goal of retaining the original policy despite deviations. However, two major challenges remain when applying these techniques to VLAs. First, it remains unclear how to robustly handle a diverse range perturbations, with existing methods achieving robustness only against a limited set of environmental uncertainties (Agrawal et al. (203)). Second, it is yet unknown how to achieve action-robee robust offline RL, as OOD transitions are inevitable in real-world scenarios.
3 EVALUATING THE ROBUSTNESS OF VLAS
In this section, we evaluate the robustness of mainstream VLAS by first presenting the problem formulation, then detailing the experimental setup, and finally summarizing the main findings.
Problem Formulation. We model the decision process of VLAs as Partially Observable Markov Decision Process (POMDP) (Kaelbling et al. 1998), defined a tuple G (V, S, 0, A, R. 7). Here, V is the space of language instructions, S is the state space, O is the observation space, O the observation emission function, AA the action space, P S A + A(S) is the transition function, R: S X A X V + I is the reward function.
We follow a practical formulation similar to To (Black al. 2024). Att = 0, a language instruction sb E V was given. At time f, the robot operates in state E S. observing 2-3 RGB images and the language instruction o, (o!,...o? } (s:)). The robot takes an action chunk A, (ur, M.+1....0e++ according to its policy x <(A,o,)) The policy takes observation input and partial observability is implicitly encoded via historical input VLMs. The environment proceeds to 8141 P(- st, Ar) and receive reward r; R(s,, A,, 1.). Y [0, is the discount factor.
Robustness under uncertainties. We define test-time uncertainties for VLAs as w E Ω with Ω = {L C V, S2 C 2. S 2, S P) the uncertainty set that perturbs instructions, observations, actions and environments, respectively. Given a task th, the robustness of VLAs is defined as:
mhbsst (TT, 1/ Ewwa E Beg Ex
Σ 1=0
r Y'aa so. [6
(I)
3.1 EXPERIMENT SETTINGS
Evaluated Algorithms. We consider Open VLA (Kim et al., 2025). mo FAST (Pertsch et al. 2025) and Ro (Black et al. 2024) as representative of autoregressive and diffusion-basee VLAs, using their publicly released checkpoint. For robust VLA methods, we consider BYOVLA (Hancock et al. 2025
3

---

Published as a conference paper at ICLR 2026
Uncertainties in VLA Input
Uncertainties in VLA Output
Oniiinal Observation of
Observation Uncertainties
5 Aclion Uncertainbes
Gaussian
Dead Pixaa
Motoon Blu
Color Jiteer Image Rotation Image Shift
Original
Gaussian
Action Blas
Original Instruction
Upenn Lhe miazie doames of Law cationt. 3 Instruction Uncertainties
Sudcen Spikes
Uniform Random Flps
Lesocal
ouplosard
Syntactic
Cruid you adoody apen the xiottl draws the cabluet?
Advarsorial
think you it, kagbo? open widdle drawer, the Cabinet
Lighting Var Varation
Irrelevant Objacts
External Force
Environment Uncertainties
Figure 2: Overview of 17 uncertainty types spanning observation, environment, instruction, and action modalities, used in our evaluation of VLA robustness.
Bacillone To
Backboon: OpenVVi
Joha
Subber
Dat
Drvecenent Inituction
Ieg
Loarall
Scanall fack
Ligling
Leca tanavw
LeKOl Tanaone
Make
Nave Lovil %.
Torepe
(a) To and Open under varing noise level
(b) To vs BYOVLA
(c) TO is most robust
Figure 3: Selected results of robustness evaluation. Numerical results available in Section.
on To backbone, we use the official implementation and apply its robustness enhancement procedure only to the visual modality. Due to the lack of publicly available code and insufficient implementation details, we were unable reproduce GEVRM (Zhang et 2025) for fair comparison.
Evaluated Uncertainties. We consider 17 perturbations in action, observation, environment and instructions, see Fig. for visualization. Action uncertainties capture sensorimotor noise, actuator wear, and unexpected disturbances in VLA output, modeled by 5 types: uniform noise, Gaussian noise, action bias, random flips and sudden spikes. Observation uncertainties arise from sensory noise and camera error that affect VLA input, with 6 variants: Gaussian noise, dead pixel, motion blur, color jitter, image rotation and image shift. Environment uncertainties contains types of external influences, with external force in VLA output, irrelevant objects and lighting variations in VLA input. Instruction uncertainties represent 3 linguistic variability in VLA input, including lexical transformations at the word level, syntactic transformations at the sentence level, and adversarial prompts with ambiguity and distraction. See details in Appendix. A
Evaluation Process. algorithms. We use LIBERO benchmark suite (Liu et al. (223) for evaluation, following their official settings. Due to space limit, we report crucial experiment results that support our findings in this section and leave numerical results to Section.
For robustness evaluation,
apply each uncertainties
evaluated
3.2 EXPERIMENT RESULTS
We present our key findings below with corresponding experiment results.
Action is the most fragile modality. We first evaluate the robustness of all modalities with varying noise level. We unify noise level for all modalities as the percentage of the maximum allowable value in each modality. As shown in Fig. 3a, as the magnitude of noise increases, the robustness of action drops drastically. For example, the success rate of To are reduced 52.4% under noise 0.05 (2.5%), and fails completely at 0.1 (5%). This is in stark contrast compared with action-robust RL, where noise are often set to 0.1 or higher (Tessler et al. 2019). An explanation from offline RL theory (Levine et al. 2020) is that VLA policies trained on fixed datasets are especially vulnerable to action errors: a single mistake can drive the rollout off- off-iistribution, causing errors to accumulate quadratically with the horizon, whereas in online RL the accumulation is only linear since interaction allows partial correction. In contrast, we find VLAs more robust against uncertainties in VLA input, while non-robust against observations only high uncertainties.
4

---

Published as a conference paper at ICLR 2026
Existing visual-robust VLAs do not show improvements in other modalities. Next, we investigate the robustness of BYOVLA, an off-the-shelf visual-robust VLA that identify and replace the sensitive regions in visual input. As shown in Fig. [3b] BYOVLA improves performance under Gaussian noise by 7.3% and dead pixels by 22.3%. yet the average gain across all visual corruptions is only 4.0%. Moreover, we observe no measurable improvement (+0.0%) in non-visual modalities. These results indicate that visual robustness alone does not translate into broader robustness across other modalities, motivating our study of comprchensive multi-modal robustness in VLA models.
To demonstrates higher robustness than Open VLA and FFST.. As shown in Fig. 3c To outperforms VLA and TT- by 27.9% and 5. %, respectively. Since To and To- FAST share the same VLM backbone, this difference suggests an advantage of the diffusion- based action head. We evaluate both models under varying noise and observe that the robustness of To-FAST degrades which motivates us to develop Robust on the To backbone.
faster than To (Appendix
4 ROBUSTVLA
To counter multi-modal uncertainties, we propose RobustVLA, fine-tuning framework to enhance robustness against uncertainties in VLA inputs and outputs. We take To with rectified flow matching as an example due to its popularity, while our method naturally extends to VLAs with general diffusion-based action head and autoregressive VLAs like OpenVLA.
4.1 ROBUSTNESS AGAINST VLA OUTPUTS
Ensuring robustness against action output can be hard, since we equipped with an offline dataset, and any action noises inevitably make subsequent transitions OOD, which amplifies subsequent errors (Levine al., 2020). In our paper, taking To with rectified flow matching action head, first derive ep bounded worst-case action noise by maximizing the flow matching loss, then performing robust optimization against such noise.
Preliminaries: VLAs with Conditional Flow Matching Action Head. Given empirical observations Ao ~ 70 and A n² a flow defines an Ordinary Differential Equation (ODE) d.'" u(A', r)rr on [0. 1]. with v the velocity field to push A to A following the path defined by the ODE corresponds to simple action distribution A c~ NO. I). and flows an action from the dataset A ~ p(-lo.), (A), 0,) E D at T 1. Assuming linear- Gaussian transformation, the action at time + is formulated as A = (T (1 (1-T)I), To accelerate the learning process, rectified flow (Liu 2022) assume linear ODEs for straight flow which is casier to model and compute. The action at time T is then a linear interpolation AA = =T + (1-1177) 4P. The goal is to learn velocity field vo (AT, o.) parameterized by 0 to match the rectified flow u( A A.) = AQ- A! = c - A!- This yields the objective of To (Black et al. 2024):
@Limman et al. 2022). VLA,
min LT = (Pp(A(()).x(447444)) 1oo A7, o.) - u(AT]A))))
(2)
0
Worst-Cass Action Noise. We define worst-case action noise in VLAs as an lp bounded noise that maximally reduces the success rate. In robust RL literature, since success rate hard to measure per step, researchers assume existing well-trained policy have high chance to succeed, and maximizing deviation to current policy leads to successful attacks (Huang et al., 2017). In VLAs, offline demonstrations (or, Ar) provide actions that are more likely to lead to success and can be learned through flow matching. Therefore, we use the loss of the flow matching objective, || , oz) - uf A7 | as an empirical measure of action quality. We also conduct a pilot study in Appendix. C.5, which empirically shows flow matching loss is strongly correlated with success rate, with significant Pearson correlation of r = 0.95, p < 0.05.
Formally, we define the perturbed action as A = At + 6, where noise & is added action noise. In this noisy flow, the perturbed action at time 7 is A = = - (1 T).4f, and the perturbed rectified flow is ul (A) uuAT (A!) 6. Plugging this into the original To objective, we got:
E arg max E 
p( P(A))))) (7 10 (A7 o.) u(AT A+)1
(3)
u(AT7A)) 811..
= arg max Spc ppcAloo))
8
5

---

Published as a conference paper at ICLR 2026
Here, the noise og(Aī, oz) perturbs the action input, enforcing Lipschitz continuity of vy to stabilize action outputs under perturbations. Noise ut u(Aī maximizes loss in the direction vo(Ar,o0 or) ((4T) where velocity field and rectified flow diverge the most. In practice, we compute ó via PGD (Madry et al., 2017), a gradient-based attack method.
Robustness Against Action Noise. With the worst-case action noise enhancing robustness against worst-case å requires minimizing the conditional flow matching objective against the worst-case noise. To stabilize the result without noise, we use the TRADES objective that maintain the original To loss, which provides optimal tradeoff between robustness and accuracy (Zhang et al. 2019):
(To Aout max E P(A))o B (lo o.) ((AT)A (ATIA.))P. (4)
min LTo Sout min
where Aour is hyperparameter to control the balance between flow matching without perturbation and the robustness against noisy VLA output.
Remark 1. Robustness against action noise can be understand as flow matching against both clean and noisy action distribution. The model continues to match the clean distribution sampled from ((Ac Jo,) while additionally accounting for an adversarially perturbed alternative p(.,, + 5 5)). Training with such perturbations prepares the model for test-time noise and improves robustness.
Remark 2. Robustness against action noise can also be interpreted as a form of label smoothing (Mäller al. 2019). Injecting noise into actions makes the learned flow less certain, discouraging overconfident decisions and overfitting to specific actions. This yields better generalization and encourages more stochastic behavior that covers a wider range of plausible actions, a property shown to support robust decision-making in practice (Eysenbach & Levine 2021).
Remark 3. Robustness against action noise can be understand by penalizing outliers. Recall the noise ó approximately points in the direction vg (AA (A],o,) o.) - u( u(A7 [A]], where the velocity field and rectified flow mismatch the most. Consequently, any mismatch during training is amplified quadratically by 8 in the MSE objective of flow matching. The objective therefore acts to penalize outliers that the VLA cannot fit well, improving performance on corner cases and reducing non-robust failure modes.
Generalizing to Other VLASs. For general diffusion- based VLASs, just ignore the assumption of u(AilA)) = u[ u(ATlA!)) - 8 of rectified flow and use the first line of Eqn. to generate the worst-case action perturbation. For autoregressive VLÅs, take OpenVLA as example, we perturb the actions before binning to maximize its cross entropy loss, with robust objective following Eqn. 4 The perturbations constrained so that the action output remains within the original bin and its adjacent bins. This ensures that, even when errors occur, the outputs stay in the neighborhood of the correct action and the worst-case robustness is improved.
4.2 ROBUSTNESS AGAINST VLA INPUTS
Next, study robustness to noisy VLA inputs. These noises can have different types in varying modalities. We observe that these perturbations do not alter the underlying task semantics, so the optimal action should remain unchanged. We therefore encourage the flow-matching objective to produce similar actions under perturbed inputs. To automatically handle diverse observation types, we cast the perturbation selection as multi-armed bandit problem and use an upper confidence bound (UCB) algorithm (Auer 2002) to identify the most harmful noise for adversarial training.
Robustness to Single Noise. Given VLA policy (A) input variation can stem from various sources, including sensory noise and camera eтror in observation, or irrelevant objects, lighting variations in external environment. Although inputs may vary, the robot's underlying state does not change. That is, the robot operates in the same physical world to execute the same task. Consequently. the optimal actions should remain unchanged. For an input perturbation w E Z2 we define the flow-man How-matching objective under each input noise as:
min max wi ((Alo (1o (f (o.)) 1A)
(5)
Here, adversarially select w/ to simulate worst-case inputs. If the input noise is fixed, we leave unchanged. This objective is inspired by state- pette-perturbttoon techniques in offline RL (Shen et al.) 2020 Yang et al. 2022). Now, it remains unknown how balance many perturbations automatically.

---

Published as a conference paper at ICLR 2026
Balancing Various Noises. While RobustVLA targets robustness against broad set of perturbations, it remains unclear which perturbation types contributes most to overall performance. For instance, simple Gaussian noise can be easy to defend, yet confer little robustness to more complex noises. Assigning fixed weights to each perturbation type is possible, but manually tuning the weight for each uncertainty can be time-consuming. We therefore seek to automatically maximize overall robustness by adaptively selecting the input perturbation at each training iteration.
This selection problem can be naturally formulated as multi-armed bandit, with the goal of maximizing the overall robustness of the VLA policy. At each training step n, the algorithm selects an uncertainty wf E Ω train the objective in Eq. 6 The UCB algorithm (Auer, 2002) provides a principled way to solve multi-armed bandits. Given the times each uncertainty has been explored as w' (n)) at th training iteration, the uncertainty is selected as:
log(n) I'm rn(w*)) + av w w'(n)
_ UCB(S, n) = arg max
(6)
where a > O is the exploration coefficient. To prioritize robustness, we define the reward as the increase in the flow-matching loss induced by the perturbation, i.e., the gap between the noisy and clean objectives for the same (o,, Ar) pair:
I' (m((w²) R (y(Ailo)).((4f11)1ll1o
(o:)) u(AT]A))] (A5, - u(AT] (7)
To stabilize the reward, we apply z-score normalization with the mean and standard deviation maintained by an exponential moving average, with decay factor of 0.9. Equipped with the UCB-selected uncertainty type wi, the training objective against diverse input noise becomes:
min L% C min + Ain max EE P(A no (A7, (o.)) ul u(A714,)11 (8)
wi
where Ain balances the un loss and the input robustness term. Finally, to enhance local smoothness of VLAs, add a Ep bounded observation noise y) to maximize the flow matching loss of C computed via PGD (Madry et al., 2017), which works well empirically.
Generalizing to Other VLAs. For other diffusion- VLAs, our method can be applied by changing the rectified flow matching loss directly. For autoregressive VLAs, we apply the perturbation to observations and then map to action tokens, the remaining procedure is unchanged.
Overall RobustVLA Loss. Finally, we combine robustness to input and output perturbations with the No objective. Let Ain and Aout hyperparameters that weight the input- and oubput-robustness terms within Ln and Co respectively. The overall training objective is:
min Ctobustt
min CT + Cin + Cout.
0
The pseudocode of our RobustVLA is given in Appendix.
D
5 ROBUSTVLA EXPERIMENTS
Experiment Setting, Consistent with the robustness evaluation in Section 3.1 we assess all methods under the same 17 perturbations using the LIBERO benchmark and its recommended setup. We conduct our main experiment on To backbone due to its superior robustness compared with VLA. We compare YOVLA (Hancock et al. 2025), an off-the-shelf robust VLA method designed for visual uncertainties as our baseline. Our approach is termed RobustVLA. For our main experiments, we also consider four ablations of our RobustVLA, including: (1) domain randomization (DR) variant that trains To using randomly selected VLA input perturbations, (2) our RobustVLA without input regularization (w/ in), (3) our RobustVLA without output regularization (w/o out), (4) our RobustVLA without UCB for balancing multiple input noises (w/o UCB). We also evaluate RobustVLA on the Open VLA backbone under the same setting. All reported improvements are absolute gains in success rate, expressed in percentage points.
Implementation Details. We follow the default training recipe for no and OpenVLA as recommended in their original codebase. For our RobustVLA, observation noise 1) as 8/ 8/255. All baselines use the same set of hyperparameter and implementations. See implementation details and additional training details in Appendix B
set Amn Aout as 1, action noise 8 as 0.03, and
7

---

Published as a conference paper at ICLR 2026
Table Average success rate (%) under 17 noise types on LIBERO tasks, evaluated on To backbone.
Noise Modality
Noise type
30
DR
BYOVLA
w/o in
w/o
w/o RobustVLA((uur
w/o Noise
96.0
94.8
95.2
96.0
94.9
94,9
95.5
Unitom Noise
63.5
61.2
62.0
67.3
66.8
69.5
69.8
Noise
36.3
36.0
Action
Action Bias
23.0
27.6
21.2
44,9
37.0
41.3
42.3
Random Flips
52.7
48.5
$1.6
56.9
54.0
57.6
58.7
Sudden Spikes
51.7
54.2
51.1
58.5
52.7
62.3
59.7
Gaussian Noise
51.4
64.1
58.7
55.7
94,5
84,3
93.8
Pixel
78.5
93.8
Observation
Motion Blur
93.7
88.7
95.2
94,1
95.0
95.2
95.5
Color Jitter
61.7
54.0
54.2
53.9
58.7
62.3
69.5
Image Rotation
73.3
85.9
77.7
64.1
94.0
70.7
94.4
Image Shift
74.6
72.3
70.4
63.2
89.2
62.3
92.7
Force
37.1
31.9
37.3
39.0
39.0
40.8
Environment
Irrelevant Objects
93.1
80.8
93.7
91.2
89.9
91.2
94.2
Lighting Variation
94.3
89.0
95.0
94.6
94.3
92.4
95.6
Lexical Transform
78.7
78.8
79.5
81.5
17.7
17.1
91.3
Instruction
Syntactic Transform
84.7
72.3
85.8
84.0
82.3
83.6
93.9
Adversarial Prompts
79.2
56.7
80.1
75.7
72.2
74.6
80.2
Average
62.6
61.8
64.0
64.8
71.7
69.3
76.6
5.1 ROBUSTVLA Ny BACKBONE
RobustVLA is more robust on backbone. We compare RobustVLA against all non-ablated baselines under perturbations. As shown Table. T RobustVL.A gains higher robustness on all 17 perturbations, outperforming To by 14.0% and baseline BOVLA by 12.6% average robustness. Under clean conditions without perturbation, RobustVLA remains competitive with To (95.5% vs. 96.0%), showing robustness gains do not at the expense of clean performance. Notably, method also generalizes to unseen perturbations not encountered during training, such as external forces, demonstrating robustness beyond the set of uncertainties considered during training. A separate analysis on LIBERO-Iong highlights the potential of RobustVLA on complex and long- horizon tasks, outperforming To by 19.61% % in success rate. See results in Appendix. OK
Results also confirmed action as the modality worth further investigation, with our method achieving +8.0% success rate on average, comparing with +1.22% increase uncertainties applied VLA input.
Analysis on ablations. We further compare Robust with ablated variants that remove input regularization (Ours w/o in) or output regularization (Ours w/o our). RobustVLA achieves higher robustness than both ablations in 14/17 perturbations. This suggests robustness aimed at one modality can also benefit others. To explain, output robustness helps counter action drift induced by input noise, whereas input robustness improves generalization to the unseen transitions induced by action noise. As an evidence, even without input regularization, Ours w/o in retains notable gains on Dead Pixel, observation perturbation. Similarly, removing output regularization, Ours w/o out still gains robustness on Uniform Noise and Action Bias, two perturbations on actions. These results implies multi-moda robustness a promising route toward generally robust VLAs.
For DR and Ours w/o UCB, several patterns emerge. First, DR performs poorly. While DR improves robustness to observation noises, it fails under most environment and instruction noises, likely because it overfits to a small subset of easy perturbations. Second, Ours w/o UCB shows a 7.3% drop in robustness, indicating that UCB is crucial for balancing multiple perturbations rather than letting the model overfit to single dominant noise source. Comparing with Ours w/o in that trains on output noise only, adding exposure to diverse input noises adds further robustness gains, even without UCB.
5.2 DISCUSSIONS
In this section, we demonstrate that RobustVL.A consistently effective on the Open VLA backbone, achieves greater computational efficiency than the visual-robust BYOVLA, and maintains robustness under mixed perturbations applied on input and output.
RobustVLA is also robust Open VLA backbone. Beyond mo, RobustVLA is also consistently effective on the autoregressive based Open VLA. As shown Fig. 4al RobustVLA improves average robustness by 13.2% over OpenVLA. surpasses the baseline BYOYLA by 10.4%, demonstrating the effectiveness of RobustVLA across diffusion- based and autoregressive VLAs. The detailed numerical results presented in Appendix C.I
8

---

Published as a conference paper at ICLR 2026
OpenvLA
BYDOLA
578.85
51.2
Suczaaa Iate
Acange
297
11.41
Action
Observation
Unsinomment
Insh .don
Aveage
Fu
7g
BVOWL
RebueeWA
(a) OpenVLA Backbone
(b) Inference Speed
(c) Mixed Perturbation
Figure 4: RobustVLA improves robustness on the Open VLA backbone, achieves fast inference speed, and withstands mixed perturbations.
Action
Observation
Environment
Instruction
Success %
87.5
TTp
85.0
82.5
BYOVLA
RobustVLA
22.5
30.0
22.5
20.0
10.0
Task 1: pick up the blue bow plate
Task pick up the plate
Task put the breed plate
Task 4: put the green cup next the green plate
X
Baseling
mag beside...
Imprecise Control
Obscure Input
OOD
Misinterprotation
Figure 5: Real-world robustness results. Our RobustVI.A is highly effective with scarce demon- strations, while baselines fail due to imprecise action control, obscure observation input, OOD observation and language misinterpretations.
RobustVLA is computationally efficient. As shown in Fig. 4b RobustVLA achieves a per-episode inference time of 11s, comparable to Ty since they share the same architecture and parameter size. In contrast, RobustVILA is 50.6x more efficient than B BYOVLA, visual-robust VI.A method. This large gap arises because BYOVLA relies on a visual sensitivity probe, which requires multiple forward passes identify sensitive visual regions of current VLAs and makes repeated calls to external LLMs to modify these regions, resulting significant computational overhead.
RobustVLA LA is robust against mixed perturbations applied on input and output. To test this, randomly sampled one uncertainty in VLA input and one uncertainty in VLA output, from categories defined in Fig. We test the results To backbone, with random seed fixed to ensure all baselines were tested under the same set of uncertainties. As shown in Fig. 4 RobustVL.A achieved a 14.5% higher robustness than mo and gains 10.4% robustness than baseline BYOVLA. These improvements are statistically significant (p < 0.001, paired-sample t-test).
5.3 HEAL--WORLE EXPERIMENTS
Real-world setup. We deploy VLAs on Fairino FR5 robotic arm with a Hitbot Z-EFG-C50 gripper. Visual inputs are provided by ZED2 externl camera and an Intel RealSense 435i wrist-mounted camera. We design four tasks to assess real-world performance: (1) pick up the blue bowl on the blue plate; (2) pick up the bowl the plate with randomized colors; (3) place the bread the plate: and (4) place the green cup next to the green plate. These tasks test VLA's capability on basic grasping, semantic generalization. deformable object manipulation, and spatial reasoning. For each task, we tin-ttun To with 25 demonstration trajectories. All methods achieve 100% success without perturbation after fine-tuning.

---

Published as a conference paper at ICLR 2026
Real-world noise. We design physical noise sources for robustness evaluation. For environmental noise, we vary lighting by adding a neon bubble and introduce irrelevant objects into the testing scene. For action noise, we perturb motor calibration and introduce interference in serial communication. For instruction noise, we use a speech recognition model to process human speech containing dialects, unusual word order, or irrelevant content. For observation noise, apply the same perturbations as in simulation. However, we omit external forces since they could physically damage the robot. For each noise modality, we conduct 10 trials per task and report aggregated results over tasks.
Real-world performance. As shown in Fig. 5 RobustVLA is highly effective in real-world de- ployment, surpassing the best baseline by 65.6% in success rate. We attribute this to the limited 25 demonstrations of real-worke trajectories available for fine-tuning. Unlike large and diverse simulation datasets such as LIBERO, laboratory-collecte data are costly and offer limited state coverage, leading baseline VLAs to overfit demonstrations and fail under perturbations. In contrast, by anticipating noise during training, RobustVLA anticipates potential noise during training and remains robust unexpected real-world disturbances. See per-task results in Appendix C.6
Failure Analysis. Finally, we analyze the fail- ure mode of baselines, aggregating To and BY- OVLA due to their similar behaviors. As illus- trated in Fig. 5 (1) under action uncertainties, baselines exhibit imprecise control, resulting in
100
92,5%
92.5% *
95.0%
75
Success Rate
65.0%
the gripper unable to grasp the bowl precisely
60.0%
50
and occasionally knocking the bowl over; (2)
under observation uncertainties, input noise ob-
37.3%
25
scures the visual signal, making the robot unable to identify the object clearly; (3) under environ- ment shifts, the added neon light produces severe illumination change that renders obser- vations OOD; and (4) under instruction noise, speech parsing errors lead to misinterpretatton, making robots placing the cup "beside" the ta- ble. In contrast, RobustVLA remains reliable in most trials, achieving consistent success in the real world. See demo videos in our codebase.
RobustVLA
Tp
25
50
100
Number of Demonstrations
Figure 6: Results with more demonstrations. Al- though Tn becomes more robust as additional data is provided, Robust already achieves strong robustness in the low-data regime and consistently outperforms To across all data scales.
Results with More Demonstrations. We evaluate our performance with 50 and 100 demonstrations in Task 1 to show results with sufficient data. While all methods achieves 100% success rate, as shown in Fig. [6] no gains robustness with additional data. The success rate of x increases from 37.5% 25 demos to 60.0% at 50 demos and 65.0% at 100 demos. This shows real-world robustness benefits from additional trajectories with higher data diversity. Comparing with baselines, our RobustVLA is highly robust in low-data regime, and consistently outperforms
across all data scales. Our success rate reaches 92.5% 25 demos, 92.5% at 50 demos and 95.0% at 100 demos, while the baseline plateaus at 65.0%, achieving 30% robustness gain than To. showing RobustVLA provides substantial robustness gains beyond what achievable through additional demonstrations alone.
CONCLUSION
In this paper, we evaluate and enhance the robustness of VLA models under multi-modal uncertainties. We evalute mainstream VLAs against 17 perturbations across four modalities, showing that actions are the most fragile, existing visual-robust VLAs fail to generalize beyond vision, and To the most robust backbone. Building on these insights, we propose RobustVLA, a unified framework against input and output perturbations. For output robustness, we perform offline optimization against worst-case action noise that maximizes flow mismatch. For input robustness, we enforce consistent actions across semantically equivalent inputs and automatically identify the most harmful perturbation using UCB. On LIBERO, RobustVLA delivers absolute gains of 12.6% on mo and 10.4% on Open across 17 perturbations, achieves 50.6x faster inference than visual-robust BYOVLA, and improves robustness by 10.4% under mixed perturbations. Real-world FR5 robot under perturbation shows RobustVLA is highly robust with limited data, outperforming mo by 65.6% success rate with 25 demos. With sufficient demos, our RobustVLA continues to maintain high robustness, achieving 30% higher success rate than no.
10

---

Published as a conference paper at ICLR 2026
7 ACKNOWLEDGEMENT
This study was supported in part by the National Natural Science Foundation of China Project No. 62476018 and 62322318 and part by the InnoHK initiative of the Innovation and Technology Commission of the Hong Kong Special Administrative Region Government via the Hong Kong Centre for Logisties Robotics, and part by National Key R&D Program China Project 2022ZD0161 100.
8 ETHICS STATEMENT
Our research focuses evaluating and enhancing the robustness of VLA models. By systematically studying their vulnerabilities under diverse uncertainties and proposing methods for robustness improvement, our work assists researchers and engineers in developing and deploying VLAs in environments where safety, stability, and reliability are critical. We emphasize that our study does not introduce adversarial attack techniques, and is designed to provide constructive insights that strengthen the trustworthiness of embodied Al systems.
REPRODUCIBILITY STATEMENT
We have open sourced all our code for robustness evaluation and enhancement in https //github. com/ htt.:/aalaa////ooot/////// Additional experiment details are available in Appendix
REFERENCES
Aakriti Agrawal, Rohith Aralikatti, Yanchao Sun, and Furong Huang. Robustness to multi-modal environment uncertainty in marl using curriculum learning. arXiv preprint arXiv:2310.08746. 2023.
Peter Auer. Using confidence bounds for exploitationnexxlorriio trade-offs. Journal of machine learning research, 3(Nov):397-422, 2002.
Johan Bjorek, Fernando Castañeda, Nikita Cherniadey, Xingye Da, Runyu Ding, Linxi Fan, Yu Fang, Dieter Fox, Fengyuan Hu, Spencer Huang, et al. Gr(Ot nl: An open foundation model for generalist humanoid robots. arXiv preprint arXiv:2503.17734 2025.
Kevin Black, Noah Brown, Danny Driess, Adnan Esmail, Michael Equi, Chelsea Finn, Niccolo Fusai, Lachy Groom, Karol Hausman, Brian Ichter, et al. क: A vision-language-actinn flow model for general robot control. CORR, 2024.
Anthony Brohan, Noah Brown, Justice Carbajal, Yevgen Chebotar, Joseph Dabis, Chelsea Finn, Keerthana Gopalakrishnan, Karol Hausman, Alex Herzog, Jasmine Hsu, et al. Rt-1: Robotics transformer for real-world control at scale. arXiv preprint arXiv:2212.068117 2022.
Benjamin Eysenbach and Sergey Levine. Maximum entropy (provably) solves some robust problems. arXiv preprint wrXiv:2103.06257: 2021.
Asher Hancock, Allen Z Ren, and Anirudha Majumdar. Run-time observation interventions make vision--anguage-action models more visually robust. In 2025 IEEE International Conference on Robotics and Automation (ICRA), pp. 9499-9506. IEEE, 2025.
Sandy Huang, Nicolas Papernot, Ian Goodfellow, Yan Duan, and Pieter Abbeel. Adversarial attacks on neural network policies. arXiv preprint
2017.
Garud N Iyengar. Robust dynamic programming. Mathematics of Operations Research, 30(2): 257-280, 2005.
Leslie Pack Kaelbling, Michael Littman, and Anthony R Cassandra. Planning and acting in partially observable stochastic domains. Artificial intelligence, 101(1-2):99-134, 1998.
11

---

Published as a conference paper at ICLR 2026
Moo Jin Kim, Karl Pertsch, Siddharth Karamcheti, Ted Xiao, Ashwin Balakrishna, Suraj Nair, Rafael Rafailov, Ethan Foster, Pannag R Sanketi, Quan Vuong, et al. Openvla: An open-source vision- sasio-language-acce model. In Conference Robot Learning. pp.
PMLR, 2025.
Sergey Levine, Aviral Kumar, George Tucker, and Justin Fu. Offline reinforcement learning: Tutorial, review, and perspectives on open problems, arXiv preprint urXiv:2005.01644 2020.
Qixiu Li, Yaobo Liang, Zeyu Wang, Lin Luo, Xi Chen, Mozheng Liao, Fangyun Wei, Yu Deng. Sicheng Xu, Yizhong Zhang, al. Cogact: foundational ussio-languagg--cttion model for synergizing cognition and action in robotic manipulation. arXiv preprint arXiv:2411 2024.
Yaron Lipman, Ricky TQ Chen, Heli Ben Ben-Hamu, Maximilian Nickel, and Matt Le. Flow matching for generative modeling. arXiv preprint arXiv:2210.02777,, 2022.
Bo Liu, Yifeng Zhu, Chongkai Gao, Yihao Feng, Qiang Liu, Yuke Zhu, and Peter Stone. Libero: Benchmarking knowledge transfer for lifelong robot learning. Advances in Neural Information Processing Systems, 36:44776-44791, 2023.
Qiang Liu, Rectified flow: marginal preserving approach to optimal transport. arXiv preprint 20w::2299.1477, 2022.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint (kdv::770.06000 2017.
Daniel J Mankowitz, Nir Levine, Rae Jeong, Yuanyuan Shi, Jackie Kay, Abbas Abdolmaleki, Jost To- bias Springenberg, Timothy Mann, Todd Hester, and Martin Riedmiller. Robust reinforcement learning for continuous control with model misspecification. arXiv preprint 1rXiv:1906.075/1 2019.
Rafael Müller, Simon Kornblith, and Geoffrey E Hinton. When does label smoothing help? Advances in neural information processing systems, 32, 2019.
Arnab Nilim and Laurent El Ghaoui. Robust control of markov decision processes with uncertain transition matrices. Operations Research, 53(5):780-798, 2005.
Abby O' Abdul Rehman, Abhiram Maddukuri, Abhishek Gupta, Abhishek Padalkar, Abraham Lee, Acorn Pooley, Agrim Gupta, Ajay Mandlekar, Ajinkya Jain, et al. Open x-embodiment: Robotic learning datasets and rt-x models: Open x-embodiment collaboration O. In 2024 IEEE International Conference on Robotics and Automation (ICRA), pp. 6892-6903. IEEE, 2024.
Kishan Panaganti, Zaiyan Xu, Dileep Kalathil, and Mohammad Ghavamzadeh. Robust reinforcement learning using offline data. Advances in neural information processing systems, 1222222111224 2022.
Kishan Panaganti, Zaiyan Xu, Dileep Kalathil, and Mohammad Ghavamzadeh. Distributionally robust behavioral cloning for robust imitation learning. In 2023 62nd IEEE Conference on Decision and Control (CDC), pp. 1342-1347. IEEE, 2023.
Karl Pertsch, Kyle Stachowicz, Brian Ichter, Danny Driess, Suraj Nair, Quan Vuong, Oier Mees, Chelsea Finn, and Sergey Levine. Fast: Efficient action tokenization for ssioo-language-acctin models. arXiv preprint arXiv:2501.007477 2025.
Lerrel Pinto, James Davidson, Rahul Sukthankar, and Abhinav Gupta. Robust adversarial rein- forcement learning. In International Conference on Machine Learning, pp. 2817-2826. PMLR, 2017.
Delin Qu, Haoming Song, Qizhi Chen, Yuanqi Yao, Xinyi Ye, Yan Ding, Zhigang Wang, Jia Yuan Gu, Bin Zhao, Dong Wang. et al. Spatialvla: Exploring spatial representations for visual- Languag-- action model. arXiv preprint arXiv:2501.1588 2025.
Mare Rigter, Bruno Lacerda, and Nick Hawes. Rambo-rl: Robust adversarial basel-based offline reinforcement learning. Advances in neural information processing systems, 35:16082-16097, 2022.
12

---

Published as a conference paper at ICLR 2026
Ranjan Sapkota, Yang Cao, Konstantinos Roumeliotis, and Manoj Karkee. Vision-language--ction models: Concepts, progress, applications and challenges. arXiv preprint arXiv:2505.04769 04769, 2025.
Stefan Schaal. Learning from demonstration. Advances in neural information processing systems, 9, 1996.
Seokin Seo, Byu Lee, Jongmin Lee, HyeongJoo Hwang, Hongseok Yang. and Kee-Eung Kim. Mitigating covariate shift in behavioral cloning via robust stationary distribution correction. Advances in Neural Information Processing Systems, 37:109177-109201 2024.
Qianli Shen, Yan Li, Haoming Jiang, Zhaoran Wang, and Tuo Zhao. Deep reinforcement learning with robust and smooth policy. In International Conference Machine Learning, pp. 8707-8718.
PMLR, 2020.
Octo Model Team, Dibya Ghosh, Homer Walke, Karl Pertsch, Kevin Black, Oier Mees, Sudeep Dasari, Joey Hejna, Tobias Kreiman, Charles Xu, et al. Octo: An open-source generalist robot policy. arXiv preprint arXiv:2405.12215. 2024.
Chen Tessler, Yonathan Efroni, and Shie Mannor. Action robust reinforcement learning and applica- tions in continuous control. In International Conference on Machine Learning, pp. 6215-622 PMLR, 2019.
Jingkang Wang, Yang Liu, and Bo Li. Reinforcement learning with perturbed rewards. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pp. 6202-6209, 2020.
Zhijie Wang, Zhehua Zhou, Jiayang Song, Yuheng Huang, Zhan Shu, and Lei Ma. Vlatest: Testing and evaluating vision- langunl--nagaeeeeaee action models for robotic manipulation. Proceedings of the ACM on Software Engineering. 1115-1)1 2025.
Rui Yang, Chenjia Bai, Xiaoteng Ma, Zhaoran Wang, Chongjie Zhang, and Lei Han. Rorl: Robust offline reinforcement learning via conservative smoothing. Advances in neural information processing systems, 15:23851-23866 2022.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pp. 7472-7482, PMLR, 2019.
Hongyin Zhang, Pengxiang Ding, Shangke Lyu, Ying Peng, and Donglin Wang. Gevrm: Goal- expressive video generation model for robust visual manipulation. In The Thirteenth International Conference on Learning Representations, 2025.
Huan Zhang, Hongge Chen, Chaowei Xiao, Bo Li, Mingyan Liu, Duane Boning, and Cho-Jui
Hsieh. Robust deep reinforcement learning against adversarial perturbations state observations. Advances in Neural Information Processing Systems, 33:21024-211
2020.
Huan Zhang, Hongge Chen, Duane Boning, and Cho-Jui Hsich. Robust reinforcement learning on state observations with learned optimal adversary. arXiv preprint 2xXiv:2101008452 2021.
Yifan Zhong, Fengshuo Bai, Shaofei Cai, Xuchuan Huang, Zhang Chen, Xiaowei Zhang, Yuanfei Wang, Shaoyang Guo, Tianrui Guan, Ka Nam Lui, et al. A survey vision-language-action models: An action tokenization perspective. arXiv preprint arXiv:2507.01925, 2025.
Brianna Zitkovich, Tianhe Yu, Sichun Xu, Peng Xu, Ted Xiao, Fei Xia, Jialin Wu, Paul Wohlhart, Stefan Welker, Ayzaan Wahid, et al. Rt-2: sssio--anguage-actionn models transfer web knowledge to robotic control. In Conference on Robot Learning, pp. 2165-2183. PMLR, 2023.
13

---

Published as a conference paper at ICLR 2026
APPENDIX FOR "ON ROBUSTNESS OF VISION- LANGUAGE-ACTION MODEL AGAINST MULTI-MODAL PERTURBATIONS"
Declaration of LLM usage. We use I.M to polish text only and authors have carefully checked all contents in the paper.
A EVALUATION UNCERTAINTIES
To systematically evaluate the robustness of VLAs, consider uncertainties in actions, observations, environment, and instructions. For each type of uncertainties, we first relate to practical sources of uncertainty in real-world, provide formal definition, and describe the implementation details.
As defined in Section. 3 we define robustness of VLAs against perturbations w E Q, where (Ny, Ro, Sa, 2p corresponds langauge, observation, action and environment dynamic, respectively. The perturbed variables are denoted as v. oG, A., and P.
A.1 ACTION UNCERTAINTIES
In this paper, consider 5 action noises related sensorimotor noise, actuator wear and unexpected perturbations. A summary of these threats are available at Table 2 Formally, we use A, E Rd to denote the action vector produced by the policy time step t, where Ar,; is its i-th component. We use A (with components A.,a) to denote the perturbed action after injecting noise. We describe details of each noise below.
Table 2: Summarization of action uncertainties.
Uncertainty Type
Mathematical Formulation
Practical Sources
Uniform Noise
A, tG, e~ c~U((ooo)
Sensorimotor Noise
Gaussian Noise
4, = 4,t,, (~N(0,
Sensorimotor Noise
Action Bias
A, A A...1
Actuator Wear
& <Pp 0.5
Random Flips
A
-1
& <<pAA 0.5
Unexpected Perturbations
Ar,i
otherwise
[A,i + sign(E.) K <p otherwise
Sudden Spikes
Ar,
Unexpected Perturbations
Ar,i
Uniform Noise. Uniform noise is random perturbation uniformly distributed within a fixed interval. simulates sensorimotor noise, such as bias in motor response or random interference in sensor measurements. In the evaluation, the value of was set to 0.04.
A, A +e,
E~U((o,
Gaussian Noise. Gaussian noise is a random perturbation drawn from normal distribution, with fluctuations centered around zero. simulates sensorimotor noise such as sensor thermal noise, micro-vibration. or irregular actuator responses. In the evaluation, the value of set 0.3.
A = A + c~ C~1,00
Action Bias. Action bias introduces a fixed offiset across all action dimensions, resulting in consistent deviations from the intended control signal. It models actuator over time, calibration drift and joint zero-po prontpoint misalignment. In the evaluation, the value of a was set to 0.03.
Å A, 1
14

---

Published as a conference paper at ICLR 2026
Random Flips. Random flips replace selected action components with extreme values, creating abrupt deviations from normal behavior. This mimics unexpected disturbances such as sudden shocks from extemal disturbances, communication bit flips or actuator sticking and slipping. In the evaluation, the probability was set to 0.05.
{
& <
& 0.5, Ae,i otherwise
5, ~ ((,
Sudden Spikes. Sudden spikes are abrupt, high-amplitude perturbations that occur with a certain probability. They simulate unexpected perturbations such actuator jitter, control signal surges, or abrupt shocks the mechanical system. In the evaluation, the probability was set to 0.05 and the spike magnitude set 1.
[ [Ac + a sign(E.) Ari
[ < p, & ~ ((00
Å
otherwise
A.2 OBSERVATION UNCERTAINTIES
In this paper, we consider observation noises related to sensory noise and camera error. A summary of these threats are available Table. 3 Formally, we use o, E #xXCC denote the observation (image) received by the policy at time step f, where ot,i, denotes the pixel intensity at location (i. use o, (with components or. to denote the corrupted observation after injecting noise. We describe details of each noise below.
Table Summarization of Observation Uncertainties.
Uncertainty Type
Mathematical Formulation
Practical Sources
Gaussian Noise
0. ccipp(: + e, 0, 255), e~ o0)
Sensory Noise
255
E. < <pA < 0.5
Dead Pixel
ō,,1, 0
E. < G.j 2 0.5
Sensory Noise
otherwise
Motion Blur
6, O Go
Camera Error
Color Jitter
6, S. Cg (o:)
Sensory Noise
Image Rotation
6//i. = o. R, (i.j)]
Camera Error
Image Shift
ór[i. o, Ai,j Aj]
Camera Error
Gaussian Noise. Gaussian noise an additive perturbation where pixel values fluctuate around the mean according to normal distribution. It simulates sensory noise including thermal fluctuation, dark current, and stochastic variations imaging sensors. In the evaluation, the noise standard deviation was set to 70.
à = clip(o; + c, 0, 255), c~ N Iwwc)
Dead Pixel. Dead pixel noise is an impulsive perturbation that forces certain pixels to extreme values (0 or 255). It simulates sensory errors such dead pixels, stuck pixels, bit emors in image transmission. In the evaluation, the corruption probability was set to 0.1.
255
EL < p Sus 0.5
0
Ei, < Gi. 2 0.5, EigsGis u(0,
Or,i.
otherwise
Motion Blur. Motion blur is a smoothing perturbation introduced by spatial convolution with Gaussian kernel. It simulates camera error include shake, defocus, object motion relative the
15

---

Published as a conference paper at ICLR 2026
camera. We denote the blur standard deviation by o, the convolution kernel size by K, and the kernel half-width by l =
K K-1, so that the kernel spans indices 2, v E [-k, k.. In our evaluation, we set
2
and K 5.
k
ó[(i.]] =
Σ
Σ
- u.j- p-j-j 2), (u = 2TO e
20
Color jitter. Color jitter is a composite perturbation that adjusts image brightness, contrast, saturation, and sharpness. It simulates sensory errors like uneven gain in CMOS/CCD, lighting variation, white balance errors or automatic camera gain fluctuations. In the evaluation, the maximum perturbation factor was to 0.4 for all adjustments.
6, S. Cp Bs(o:)
where Bs, Cs, S. represent the brightness, saturation, and sharpness enhancement functions, respec- tively. Their intensity parameters B, are independent random perturbation factors sampled based on max factor = 0.4.
Image rotation. Image rotation is geometric perturbation that rotates pixels around the image center. It simulates camera eтror induced by robot tilting, changes in camera orientation, or misalignment in the mounting system. In the evaluation, the rotation angle 8 was randomly sampled within a bounded interval [-og, oa). In the evaluation, the value of was set to 20".
i o. (R(RR'((,))) (t,5)). R = coos 0
sin 0
cos 0 0 ~ @~U(-00.00)
sin 0
Image shift. Image shift is a translation perturbation that displaces pixel coordinates by offsets proportional to the image dimensions. It simulates camera vibrations, miscalibration, abrupt movements during perception. We denote the maximum shift fraction of the image dimensions by Asiit In the evaluation, the value of Ashin was set to 0.15.
Ai ~ U( Ashn H, A H)
6,[4,]] = o - Ainj Ail,
Aj u( shin W, Ashin W)
A.3 ENVIRONMENTAL UNCERTAINTIES
Environment uncertainties consider external influences. This can happen either in VI.A input and output. this paper, we consider external force VIAA output. For VI.A input, we consider addition of irrelevant objects and lighting variations. This results in 3 environment uncertainties in total.
External Force. External force represents an exogenous disturbance applied directly the robot's body or joints, rather than an error in its internal control signals. Unlike action uncertainties, which arise from sensorimotor noise or actuator imperfections affecting the executed commands, external forces originate from the environment and perturb the robot independently of its control policy. Such disturbances occur in real-world settings when a human pushes the robot, when the robot collides with obstacles, when interacts with moving objects in a cluttered environment. These forces are inherently non-deterministic in both timing and magnitude, making them a critical source of uncertainty during deployment. the evaluation, we apply external force F Fextemal in addition to the control force F :oontol:
= F. LE 1E Ar.]
F Fotal
F Foontrol
F external
where
F Fexteral
(10)
otherwise
Here, Fo denotes the disturbance magnitude and d the direction vector. We set Fo 200 N along (1, 0, 0) (x-axis), with each application lasting + 2 timesteps and occurring at random intervals of 40-50 steps emulate unpredictable external perturbations.
Irrelevant Objects.To evaluate the robustness of VLA models, we introduced additional distractor objects into the environment. Specifically, during task execution we placed assets drawn from unrelated tasks in close proximity to either the target object or the designated goal location. The number of distractors was fixed to three. We note that, in experiments, this setting already
16

---

Published as a conference paper at ICLR 2026
approaches the upper bound supported by the LIBERO environment: adding more distractors frequently leads to spatial conflicts during initialization.
Lighting Variations. Lighting variation is an observation-level uncertainty caused by fluctuations in natural or artificial illumination. Such changes may oceur in real-world settings due to moving light sources, shifting daylight, or shadows cast by dynamic objects in the environment, all of which can significantly alter the visual appearance of scene. To simulate these effects, we adopt the Phong reflection model, where the total intensity at surface point is given by:
= la + La + Is. L ka Light max 1),
(11) (12)
with La Ia and 1, denoting the ambient, diffuse, and specular components, ka the diffuse reflection coefficient, the surface normal, and I the direction vector the light source.
In our evaluation, the illumination intensity Light was sampled from a Gamma distribution Gamma(k; 0) with parameters = 1.0 and a² 1.0, producing both subtle and dramatic vari- ations. To further emulate dynamic conditions, the light direction updated every 3 simulation steps, with the azimuth angle 2d(0, 2x) while fixing the elevation at 45".
A.4 INSTRUCTION UNCERTAINTIES
In this paper, we consider 3 uncertainties, including word-level lexical transform, sentence-level syntactic transform and adversarial prompt with ambiguous or irrelevant transformations. Examples of our added uncertainties are available in Table. 4 We describe details of each noise below.
Table 4: Examples of instruction uncertainties transformations compared to the original instruction.
Type
Instruction
Original
pick up the black bowl between the plate and the ramekin and place it on the plate
Lexical Transform
Retrieve the ebony bowl situated between the dish and the ramekin and deposit it onto the dish
Syntactic Transform
Could you pick up the black bowl that is between the plate and the ramekin, and then place it on the plate with care?
Adversarial Prompt
I think you can do IT, maybe? pick up the black bBBowl, between the plate and the ramekin and place it on the plate
Lexical Transform simulates real-world variations in word usage, encompassing phenomena such as dialectal differences and synonym substitutions. This dimension introduces surface-level perturbations to characters or words while preserving core semantics and syntactic integrity. These transformations probe model resilience against lexical noise encountered in everyday communication.
Syntactic Transform addresses structural flexibility inherent in human language expression. It modifies phrase ordering, sentence patterns, and grammatical constructions, clause insertion, or punc- tuation alterations- wiihatt altering propositional meaning. This dimension tests model robustness against grammatical reconfigurations that retain identical semantic content.
Adversarial Prompts evaluates model sensitivity to contextual noise and communicative distractions. introduces semantically irrelevant content (e.g., social media tags, extraneous clauses), accidental error(OCR misrecognitions, keyboard typos) adversarial manipulations (sentiment polarity flips) while maintaining surface fluency. This dimension mimics real-world scenarios where core information must be discerned amidst misleading signals.
17

---

Published as a conference paper at ICLR 2026
B TRAINING SETTING
B.I IMPLEMENTATION DETAILS
This appendix details the implementation details used throughout our experiments. These settings were found to be effective and robust in our empirical evaluations. We provide them here to facilitate reproducibility and to serve as a reference for future work.
B.1.1 BASE TRAINING PARAMETERS
The foundational training hyperparameters for our models are summarized in Table 5 RobustVLA on the Ty benchmark, we maintained consistency with the original To setup in terms of batch size and total training steps. To optimize computational efficiency. training strategy: the action expert (a 300M parameter Gemma model) was fully fine-tuned, while the Vision-Language Model (VLM)) component was trained using Low-Rank Adaptation (LoRA). A sim- ilar A-Raeb approach was adopted for training Open VLA models but with minor modifications balance GPU memory usage and training efficiency.
For training
employed hybrid
Table 5: Base training hyper- parameters..
Parameter
Robust on
On Open
Batch Size
32
16
Training Steps
30,000
30,000
Action Expert Tuning
Full Fine-tune
VLM Tuning
LoRA
LoRA
B.1.2 UCB EXPLORATION PARAMETERS
The parameters for the Upper Confidence Bound (UCB) exploration strategy are listed in Table The UCB algorithm encourages the agent to explore less-visited states by adding an exploration bonus to the value estimate. This bonus is inversely proportional to the visit count, promoting balance between exploiting known rewarding paths and exploring new ones.
ucb exploration : This coefficient controls the weight of the exploration bonus in the UCB calculation. higher value encourages more exploration. We set it to 1.0 as a standard baseline.
This defines the size of the sliding window used calculate recent visit counts. finite window size allows the agent to "forget" old visits and re-explore states that haven't 't been visited recently, which is crucial in non-stationary environments.
ueb window size:
ueb_ema Lemeeemmaaeeeeee tina_ecca:: This parameter sets the decay rate for an Exponential Moving Average (EMA) used to smooth the visit counts. A decay of 0.9 places more weight recent visits, making the exploration bonus more adaptive to recent policy changes.
ucb wwaimmmmmmaaaa samples: The minimum number of samples required for state before the UCB bonus is applied. This prevents underexplored states with very few samples from having an excessively high and uncertain bonus.
It is important to note that while these specific values were used effectively in our experiments, they were extensively optimized. The UCB framework highly extensible and possesses significant potential for task-specifi optimization. Beyond the commonly used enhancement mechanisms, the UCB components can be easily augmented or pruned suit particular tasks or application scenarios.
Table 6: UCB exploration hyperparameters.
Parameter
Value
ucb_expl ucb_exploratioo lrnttooncooooooff
1.0
beb_window wie__indow_size ucb 1o__ema_decay
100
0.9
seb_minn_smplee
10
18

---

Published as a conference paper at ICLR 2026
B.1.3 ADVERSARIAL TRAINING PARAMETERS
The parameters for adversarial training, which includes both action- action-space and observation-space (image) perturbations, are provided in T
adv _evsellsoon (c): This is the maximum allowed perturbation magnitude, defining the &o norm ball around the original input (action or image) within which the adversarial example must lie. A larger creates a stronger but potentially less stealthy attack.
The number of iterative steps used to generate the PGD attack. More steps typically lead to more powerful adversarial example within given constraint, as the attack can better orient itself towards the steepest ascent of the loss function.
pgd steps:
pgd_alpha: The step size for each iteration of the PGD attack. It determines how much the perturbation is updated in each step. It is typically fraction of
bes__ (A); This is the weight coefficient used balance the input and output losses, which determines which measurement our optimization focuses more for robustness.
While parameters below are generally not highly sensitive our preliminary study, we of- action and image should not be set excessively large. We observed that even small ad- versarial perturbations during training sufficient confer strong robustness against larger noises during evaluation. To enhance the effectiveness of adversarial training, increasing the number of PGD steps (pgd_steps__ is recommended strategy. However, this improvement comes the cost of increased GPU memory consumption and longer training times.
fer the following guidance: the perturbation limits defined by adv eessiloo_aatiinn
adv eeleepsillo epsilon_image
Table 7: Adversarial training hyperparameters.
Parameter
Action Space
Observation Space
adv_epsilss
0.03
8/255
pgd_steps
3
3
pgd_alpha
0,01
2/255
A
1
1
B.2 DISCUSSION ON PARAMETER SELECTION
Table Average success rate (%) of the ablation study on the PGD action space parameter.
0.015
0.03(used)
0.06
Clean
96.0
95.8
95.5
93.9
Uniform Noise
63.5
66.0
69.8
68.1
Gaussian Noise
31.4
37.1
36.0
35,9
Action Bias
23.0
38.5
42.3
43.7
Random Flips
52.7
56.5
58.7
56,8
Sudden Spikes
51.7
61.1
59.7
61.5
Average
44.5
51.8
53.3
53.2
Table 9: Average success rate (%) of the ablation study on the UCB parameters.
Ours
exp_ cocf=1.5
ema=0.6
win=200
Clean
95.5
93.8
95.5
96.2
Gaussian Noise
93.8
93.9
93.6
93.7
Dead Pixel
93.8
94.0
93.4
93.6
Motion Blur
95.5
95.6
95.2
95.3
Color Jitter
69.5
72.2
68.0
70.7
Image Rotation
94.4
95.0
93.8
94.6
Image Shift
92.7
93.5
92.0
93.0
Average
90.0
90.7
89.3
90.2
19

---

Published as a conference paper at ICLR 2026
Our method involves two groups of hyperparameters: (1) the VGD-bases adversarial action perturba- tion parameters, and (2) the UCB-based adaptive noise selection parameters. As stated Appendix. B.1 the overall performance of RobustVLA is not highly sensitive to these hyperparameters. Never- theless, we provide a more detailed discussion on initialization and tuning principles.
B.2.1 PGD PARAMETERS
The parameters pgd_a pha and pgd_steps directly control the optimization strength of adver- sarial action search. In general, larger pgd_steps allow the perturbation approach a stronger worst-case solution. However, this improvement comes with increased computational cost, and we recommend practitioners balance effectiveness and resource constraints using many steps as feasible within their budget.
The perturbation magnitude adv epselpilloo lon is less intuitive reason about, and its sensitivity requires empirical validation. Table[]compare remain stable across broad range of values; all choices outperform the non-adversarial baseline by significant margin. This confirms that adv_epsi on is not sensitive in practice. value around 0.03 consistently provides strong robustness while avoiding over- per-ppetuurbtion, and it the default.
multiple values and shows that the success rates
Before introducing tuning guidelines, we provision the additional ablation results in Table 9 The UCB module shows strong robustness across different hyperparameter choices: varying the ucb ceb_exploratee aopploration_coeff
ucb_ema decay, or ucb_ _ab_wwidoww.. size only leads minor fluctuations in success rate. Larger cert_expporatiin _onfc slightly improve performance on harder corruptions, while smaller aob_ema___ sema_decay values make the selection more reactive but somewhat less stable. Enlarging the ucb_min_sste samp les provides mild stability gains. These results confirm that our default configuration offers well-balanced trade-off without requiring precise tuning.
For UCB-based adaptive perturbation selection, a good starting point is the configuration reported in Appendix. B. which has demonstrated stable performance across diverse tasks and typical noise levels.
During tuning, recommend data-driven, stability-finn strategy. If one observes sighffrequency oscillation in the training loss or overly frequent switching in selected perturbations, is advisable to increase stability by lowering ucb cec__epplo_ expllratt bration roiiionoeeeeee f., lowering ucb_ems _er_________ _______aeaa___ larging ucb__i srrb_windee siinddwwsiii size. Conversely, the loss plateaus for an extended period or the selected perturbations become overly be adjusted in the opposite direction to encourage exploration. This closed-loop adjustment ensures balance between adaptability and convergence stability.
insufficient adaptation-thenn parameters can
B.3 TRAINING LOSS
Figures. 7 and 8
report the training loss curves of under our hyperparameter configuration, using both LIBERO simulation data and real-world trajectories. Across all loss components including the clean loss, input-consiseency loss, and adversarial output loss-the curves remain smooth and stable throughout training. This indicates that the chosen PGD parameters and UCB-based perturbation scheduling provide reliable optimization landscape without inducing instability oscillatory behavior.
Given this stability, consider the presented hyperparameter setting to be robust default for training RobustVLA, If further tuning is required for new tasks or environments, practitioners can these loss patterns reference:
Excessive fluctuations or abrupt jumps in any loss component typically suggest the need to reduce the UCB exploration coefficient, increase the window size, lower the PGD step size.
Prolonged plateaus may indicate insufficient exploration or under-strength adversarial perturbation, in which case moderate increases these parameters can help.
20

---

Published as a conference paper at ICLR 2026
loss
loss_cles clean
loss jis__nnptt
lass output
6.30
0.24
6.6
0.33
6.00
Dkp
Figure 7: Loss during training with LIBERO data
loss
loss, clean
loss, input
loss, loss_output
0.8
0.00
Figure 8: Loss during training with real-world data
Table 10: Average success rate (%) under 17 noise types LIBERO tasks, evaluated Open VLA backbone.
Noise Modality
OpenVLA Unifomm Noise
Noise type
BYOVLA
RobustVLA
25.4
24.2
Action Gaussian
7.4
8.3
10.1
Action
Action Bias
11.8
12.6
24.9
Random
21.6
20.3
25.4
Sudden Spikes
22.2
21.5
28.8
Visual Gaussian
0.8
1.5
Dead Pixel
21.6
25.1
68.9
Color Jiller
31.0
37.3
38.1
Ohservation
Image Rotation
22.3
Image Shift
42.9
46.6
47.3
Motion
66.1
Lexical Transform
57.7
55.2
58.7
Instruction
Synlactic Transform
59.1
69.5
76.1
Adversarial Prompts
49.3
62.6
64.5
Irreevant Objects
72.3
72.7
77.0
Enviromment
Lighting Variation
64.4
67.4
64.9
External Force
15.0
14.6
18.2
Average
34.4
37.2
47.6
C
DETAILS OF EXPERIMENTAL RESULTS
Due to space constraints in the main text, which focused primarily experimental results and model performance across various robustness categories, more detailed data and secondary observa- tions could not be included. Therefore, provide in this appendix complementary details of our experimental outcomes to facilitate a more comprehensive understanding of this work.
C.I DETAILS OF OPENVLA EXPERIMENTAL RESULTS
We conducted comprehensive tests on VLe BYOVLA, and our enhanced RobustVLA models across our benchmark tasks. While the results analyzed by type of uncertainty have been discussed in detail in the main text, we provide the complete data details of our tests in Table 10
C.2 DETAILS AND DISCUSSION ON ROBUSTNESS TESTING OF To AND T FFST
In addition to the Fig. presented in the main paper, further compare To and Mo -ASA under progressively increasing perturbation strengths. Although these two models share the same pre-traines VLM backbone and similar policy architecture, they differ fundamentally in their action-generation mechanisms: xo employs a diffusion-based action expert, whereas FFSA produces actions autoregressively via token prediction.
To examine whether this distinction leads to different robustness characteristics, we conduct stress tests the two most fragile modalities identified in Fig. Baj action perturbations and observation perturbations. For each modality, we gradually increase the perturbation magnitude and record the resulting drop in success rate.
21

---

Published as a conference paper at ICLR 2026
Sudden Spiss
Daad Pbol
Averagge Success Rate
Actin
atar
Rutadion
Unflar Nate
Shat
Daema Rorss
Otation Ohr
Venizon
Losizl Tronfom
(%)
Spracct: Tramlorr
Inaier Objece
Figure 9: To and FA-T under varying
Figure 10: Tu vs RobustVLA in LIBERO- long
noise level
Average Suczess Ralle
Success Rate %
204
50
jetoi SautrAAAkee
1
6.0
4.5
50
Noise Level Levei(%) (%)
flow matching loss
Figure 11: mo and RobustVLA under varying noise level.
Figure 12: Effect of Flow Matching Loss on robustness of action modality.
As shown in Fig. 9 the diffusion-based consistently outperforms the autoregressive my FAST across nearly all noise levels. The performance gap widens as perturbations become more severe, reinforcing our main-paper conclusion regarding robustness differences across VLA model classes. These results provide additional evidence that diffusion-based policies possess stronger intrinsic robustness to multi-modal disturbances than their autoregressive counterparts.
C.3 DETAILS OF LONG-HORIZON TASK RESULTS
When evaluating complex and long-horizon tasks, LIBERO-Iong in the LIBERO suite ap- propriate benchmark. Therefore, we conduct an additional analysis in this section. As shown in Fig. [0 we observe that the inherently fragile action modality of the VLA To deteriorates further long-horizon tasks, while the instruction modality experiences a substantial drop due to compounding instruction-following errors. The robustness of the observation and environment modalities also declines to varying degrees. In contrast, Robust maintains strong gains in the observation and environment modalities (39.93% and 12% on average, respectively), and further improves robustness in the more vulnerable action and instruction modalities (8% and 4.33% on average, respectively). Overall, RobustVI.A achieves an average improvement of 19.61 % across all four modalities on LIBERO-long.
C.4 PERFORMANCE ROBUSTVLA UNDER VARYING NOISE LEVELSS.
In the main text, we reported robustness improvements across the full set of uncertainty types and modalities. In this appendix subsection, we further examine how RobustVL.A behaves within single modality under varying noise intensities. We focus on the two most fragile modalities identified in our evaluation, action and observation, and systematically sweep their corresponding noise levels. As shown in Figure II RobustVLA consistently achieves positive robustness gains across all tested noise levels, with average improvements of 5.6% in the action modality and 23% in the observation modality. Moreover, we observe clear trend in which robustness gains increase with noise intensity, For example, in the action modality, the improvement is only 1.3% at a noise level of 0.5% but rises to 8.7% at 5%. A similar pattern appears in observation perturbations, where the gain grows from
22

---

Published as a conference paper at ICLR 2026
1.9% at noise level of 3.9% to 74.7% at 35%. These results suggest that RobustVLA not only stabilizes performance under mild disturbances but also provides increasing benefits as perturbations become more severe.
C.5 CORRELATION BETWEEN ADVERSARIAL FLOW-MATCHIEE LOss AND ACTION ROBUSTNESS
To assess whether flow-matching loss serves as meaningful proxy for action robustness, we analyze the correlation between our adversarial flow fow-matching loss and task success under action perturbations. Conceptually, flow-matching provides a differentiable surrogate for action quality, consistent with prior work in adversarial robustness where differentiable losses are used as proxies for task-level objectives that are not directly differentiable.
In VLA imitation-learning settings, credit assignment is particularly challenging due to high- frequency control. As a result, flow-matching naturally quantifies the deviation between the model's predicted actions and expert demonstrations. Larger flow- now-matching deviations correspond to larger mismatches from the demonstrated trajectories, which intuitively reduce the likelihood of successful task execution.
Following this motivation, we measure the adversarial flow now-matching loss defined in Eq. and compare it with the corresponding success rates under action perturbations. As shown in Fig. 12 the two quantities exhibit clear monotonic trend. Quantitatively, the Pearson correlation coefficien -0.953 with p < 0.05, indicating strong and statistically significant negative correlation. Intuitively, as adversarial flow-matching loss decreases (0.0686 - 0.0240), the success rate increases correspondingly (44.5% + 53.3%).
These results confirm that adversarial flow-matching loss is a reliable and interpretable indicator of action robustness: larger worst-case deviations in the action space directly translate into lower task success rates.
C.6 DETAILS OF REAL-WORLD EXPERIMENTAL RESULTS
We present Fig. 13 the specific task success rates various methods under different uncertainties for different tasks. Furthermore, by analyzing the robot's performance, we have preliminarily identified the causes of failures in baseline models under different robustness conditions, as well as the advantages exhibited by our method:
Action Uncertainty. The baseline models exhibit pronounced sensitivity to action noise, where even minor deviations- such motor calibration errors, communication jitters, or actuator delays cause large downstream failures. In practice, once a single action deviates from the intended trajectory, the autoregressive or imitation-trained policy is unable to recover, as the SFT data seldom contain recovery demonstrations or state-reset behaviors. This results in misaligned grasps, gripper jitter, or cumulative drift of end-effector poses. As shown in Fig. 5 the baseline often displays large-amplitude oscillations and severe localization offsets.
In contrast, RobustVLA explicitly optimizes output robustness (Eq. 4 by injecting worst-case action perturbations into the fow-matching objective during training. This exposes the model to both clean and noisy action distributions, effectively smoothing the action manifold and preventing brittle, single- point failures. As result, Robust LLA produces significantly more stable controls and suppresses error accumulation from individual noisy actions.
Observation Uncertainty. Under visual corruptions such as Gaussian noise, dead pixels, motion blur, or illumination changes, baseline models frequently misinterpret object boundaries or execution states. For example, in tasks like "place the bread the plate," motion blur obscure the bread-plate contact, causing the baseline to repeatedly attempt grasp even after the object has been placed. Although BYOVLA reduces distraction from irrelevant regions, its robustness is largely confined to static visual artifacts and remains insufficient for temporal or semantic consistency.
RobustVLA mitigates these issues through input-robustness regularization (Eq. 9. which enforces consistent actions under semantically preserving perturbations. Combined with our UCs-b adaptive perturbation scheduling, the model is trained against the most harmful visual corruptions,
23

---

Published as a conference paper at ICLR 2026
enabling effective feature denoising and context-award reasoning. Consequently, RobustVLA reliaby infers state transitions and target positions even under severely degraded observations.
Environment Uncertainty. Environmental variations such distractor objects, background changes, or dynamic illumination induce OOD shifts that significantly degrade baseline performance. Because initation-based policies tend to overfit the limited demonstration distributions, they often mis-track objects, attend to irrelevant items, or misjudge their own pose when confronted with unseen layouts. In real-world tests, such failures occasionally culminate in catastrophic behaviors (e.g., descending directly toward the table when shadows alter perceived depth).
Our framework alleviates this failure mode by prioritizing perturbations that maximally increase the How-matching loss, ensuring that the model repeatedly encounters difficult OOD scenarios during training. Exposure these diverse perturbations improves target tracking and state estimation under environmental variations, resulting in robust execution even when scene layouts deviate significantly from training conditions.
Instruction Uncertainty. Baseline models are highly sensitive to linguistic variations such as synonym substitutions, word-order changes, or extraneous modifiers. Since these models often rely on shallow keyword matching rather than semantic grounding, injected linguistic noise frequently alters their interpretation of spatial relations or object references. For instance, substituting "put the cup next the plate" with "gently place the cup by the side of the dish" causes the baseline to misidentify the target position or confuse object roles, leading to failed exccution.
RobustVLA addresses this issue by enforcing rross-petturbation action consistency for language inputs as well. By treating semantically equivalent linguistic variants as invariances during training, RobustVLA learns to extract stable task-relevant cues rather than brittle lexical patterns. This significantly improves instruction-following reliability under natural linguistic variability commonly observed in real human-robot interaction.
100
300
Success Flyse
201204
2.028
Avernng
Action
Observation
Suocess Porte %
40-
co
book
Ieok
Inek Em ronment
4
1aak
leok
3 Instruction
teok 4
Auwiinge
Figure 13: Details of Real-World World Experimental Results
D PSEUDO CODE OF ROBUSTVLA
We present the pseudocode of RobustVLA implemented on backbone in Algorithm. Comparing with To. our RobustVLA gains robustness with minimal loss in clean performance by incorporating robustness against VLA input and output. In robustness against VLA input, additionally use UCB algorithm to select the best perturbation. Both robustness against VLA input and output trained using adversarial training with TRADES objective (Zhang et al., 2019), which optimally balance clean performance and robustness.
24

---

Published as a conference paper at ICLR 2026
Algorithm Pscudo Code of RobustVLA Training on To
Input: Model 0, dataset D, augmentation set ?
Output: Trained model l*
Initialize UCB balancer for f
Initialize optimizer
for step = 1 to I do
Sample batch {(o., A})} DD
// UCB Step
Select augmentation i' using UCB
w (o.) + augment(o,,,")
// Flow matching setup
Sample A N (0, I), Beta(1.5,1)
AJ
+ A (1 - A)
u A A
// Clean loss
Vo (0 A7,
Lelean f |100 ul
Liotal < Leceen
// Robust Agains! VLA Outpul
8 random perturbation
for = 1 to action pgd sodd_stepsstt do
Lout <- max Seaction Re, |1100 (or, (o), (6))(
+ PGD PPGD_uddtee( V &oCoul)
end for
Lrotal Laotai Loot // Robust Against VLA Input
{n} + random
r perturbation
for = to observation paaprrattiiioiadddpeeee steps do
_tp_steps
Pi <- max max)|[])|-e Seate Th,, Illi (w,(o)) )adv ar 1) uel""
{m} <- PGDPPD_upe (pd_uuu(dtt)) V Cin)
end for
Ltotel Liotal + Lin
Update 0 with Looitall
// UCB update
Update UCB statistics with -in end for
Return: 8" 0 0
25


Reviews:
[{"review_id": "5ybDivciYA", "reviewer": "Reviewer_hH7B", "summary": "This paper simply run a study and find analyze the robustness of multiple policy models agains 17 different perturbations and finds that the action perturbations have the most impact while Pi-0 model is the most robust one.\n\nThey propose a model, based on Pi-0, for a robust policy against all modalities perturbations. Authors show significantly better robustness for the proposed method while the success rate is also best or close to the best. The model contains 3 loss terms, one is based on pi-0, second adds robustness agains semantically preserving input perturbation (KL divergence) and the third one adds robustness against output perturbations (adversarial worst case perturbation).", "questions": "1- The worst perturbation, computed by PGD, is a theoretical worst case and not necessarily represents the robot/environment real world noise/issues distribution. How is this justified in your proposed formulation?\n\n2- How come the noise accumulation in series of actions is addressed in this formulation? I assume smallest noise in each step will be propagated and accumulated with previous and next time-steps noise.\n\n3- Rectified flow makes the modeling and compute easier, but I am not sure how it is a valid assumption for this problem. Why can we assume a constant velocity for all the steps?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 2, "contribution": 3, "strengths": "Superior results on both task accuracy and also perturbation resilience.\n\nStudy before formulation. I enjoyed the first study and findings on different methods and types of perturbations. It made the intuition behind the proposed model design clear.", "weaknesses": "Please read my questions section.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "g3uEEzCqYH", "reviewer": "Reviewer_Q9r5", "summary": "This paper tackles the challenge of multi-modal robustness in Vision-Language-Action (VLA) models, which often fail under real-world noise beyond visual corruption. Through systematic evaluation of leading VLAs (OpenVLA, π₀, BYOVLA) across 17 perturbations in four modalities (action, observation, environment, and instruction), the authors find that actions are the most fragile, visual-robust methods don’t generalize to other modalities, and diffusion-based π₀ is inherently more robust than autoregressive models.\n\nTo overcome these issues, they propose RobustVLA, a framework that enhances robustness for both outputs (actions) and inputs (visual, language, and environmental signals). It adversarially trains against worst-case action noise in the flow-matching objective and enforces consistent actions across perturbed inputs using an adaptive UCB-based noise selection strategy.\n\nOn the LIBERO benchmark, RobustVLA improves robustness by 12.6% on π₀ and 10.4% on OpenVLA, while being 50× faster than BYOVLA. In real-world robot tests, it achieves 65.6% higher success under diverse perturbations. Overall, RobustVLA provides an efficient, unified solution for building robust and reliable VLA models across all modalities.", "questions": "While the paper reports similar clean performance to π₀ (95.5% vs. 96.0%), it remains uncertain whether the robustness-oriented training objective might negatively affect performance on other standard or real-world benchmarks not included in LIBERO. Since real-world policies often require precise control in unperturbed environments, it would be valuable to evaluate whether RobustVLA maintains its performance on such original tasks without introducing unintended degradation. Could authors provide more explanations on it?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "1. Comprehensive multi-modal robustness evaluation is very important for the VLA research. The paper goes beyond the common focus on visual perturbations and systematically evaluates 17 types of noise across four modalities (action, observation, environment, and instruction). This provides one of the most complete analyses of VLA robustness to date and clearly identifies action perturbations as the dominant failure mode\n\n2. RobustVLA demonstrates consistent and significant gains in robustness across all tested modalities, with +12–13% improvement in simulation and +65% in real-world robot experiments, while maintaining clean performance and 50× faster inference compared to visual-robust baseline models. \n\n3. The framework generalizes to both diffusion-based and autoregressive VLAs (π₀ and OpenVLA) and does not rely on external large models or expensive perception modules. \n\n4. The paper is well-structured, clearly presents its findings.", "weaknesses": "1. Most experiments only cover a small set of tabletop manipulation tasks with relatively simple perturbations. The results may not fully demonstrate robustness under more complex, long-horizon, or dynamic real-world scenarios. It is unclear whether different levels of perturbations may have various performance observations. \n\n2. Discussion on trade-offs and generalization: The paper claims robustness without loss of clean accuracy, but does not explore possible trade-offs in data efficiency, stability during training, or transferability to new robot morphologies or unseen tasks. These aspects are important for assessing the general utility of RobustVLA. \n\n3. Table 1 provides results on 17 noise types, yet the analysis mostly reports average success rates without detailed per-modality insight. For example, under observation noise, RobustVLA’s improvement on “Dead Pixel” is dramatic (20.8 → 93.8%), but for “Color Jitter,” the gain is moderate (61.7 → 69.5%). The paper does not explain why certain corruptions benefit more or how robustness scales with noise level (beyond the limited Figure 3a). A deeper breakdown, e.g., visualizing robustness curves per modality or ablation across perturbation strength, would better reveal the method’s internal behavior.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "NMSr8PhHPy", "reviewer": "Reviewer_w8cu", "summary": "This paper investigates and enhances the robustness of Vision–Language–Action (VLA) models under multi-modal perturbations spanning actions, language instructions, environments, and visual observations. The study finds that action perturbations are the most fragile modality, existing visual-robust VLAs fail to generalize beyond visual noise, and the π₀ model, equipped with a diffusion-based action head, exhibits the strongest inherent robustness.\n\nTo address these weaknesses, the authors introduce RobustVLA, a unified framework that strengthens robustness through two key components:\nOutput robustness: adversarially optimzing against worst-case action noise via a flow-matching objective;\nInput robustness: enforcing action consistency under semantically equivalent input variations, with a UCB-based adaptive mechanism to prioritize the most harmful perturbations during training.\n\nExtensive experiments on the LIBERO benchmark demonstrate that RobustVLA achieves +12.6% robustness on π₀ and +10.4% on OpenVLA, while maintaining over 50× faster inference compared to prior visual-robust models. In real-world robotic evaluations, RobustVLA further improves success rates by 65.6% under combined multi-modal disturbances.", "questions": "The real-world experiments were conducted on a single robotic platform (FR5 robot). ​ Can the authors provide insights into how RobustVLA would perform on other robotic platforms or in different environments? Are there any specific limitations or challenges in adapting the framework to other systems?\n\nThe paper states that hyperparameters for UCB exploration and adversarial training were not extensively optimized. ​ Could the authors provide more details on how sensitive the framework is to these hyperparameters? Are there plans to explore optimization techniques for these parameters?\n\nThe failure analysis in the real-world experiments is insightful but could benefit from more detailed explanations of why the baselines failed under specific perturbations. This would help readers better understand the unique advantages of RobustVLA.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "- The paper presents a comprehensive evaluation of Vision–Language–Action (VLA) models under 17 perturbations across four modalities, offering a detailed analysis of their robustness weaknesses.\n- The proposed RobustVLA framework effectively improves resilience to both input and output perturbations through offline optimization against worst-case action noise and a multi-armed bandit–based adaptive training strategy.\n- RobustVLA achieves significant robustness gains while maintaining strong performance under clean, unperturbed conditions.\n- The framework demonstrates strong real-world generalization on the FR5 robot, delivering a 65.6% performance improvement under multi-modal disturbances with only limited demonstrations.\n- RobustVLA also offers high computational efficiency, achieving faster inference than prior visual-robust VLAs and eliminating reliance on external large models, making it well-suited for practical robotic applications.", "weaknesses": "- The real-world evaluation is limited to a small set of tasks conducted on a single robotic platform (FR5). Broader validation across multiple robots, environments, and task domains would strengthen the claims of generalizability.\n- The RobustVLA framework integrates several advanced components. Although each element is clearly described, the overall methodological complexity may hinder ease of adoption and reproducibility for researchers less familiar with these techniques.\n- The paper touches on the robustness–accuracy trade-off but lacks a detailed quantitative or theoretical analysis of this balance. A deeper exploration of how robustness affects clean performance across varying tasks and noise levels would provide valuable insight.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "8OPd9vMseW", "reviewer": "Reviewer_MSSU", "summary": "This paper systematically studies the robustness of Vision–Language–Action (VLA) models under multimodal perturbations and proposes RobustVLA, a unified training framework to improve VLA robustness across four modalities: action, observation (vision), environment, and instruction. The authors first design a benchmark of 17 perturbations on the LIBERO suite and find that (1) the action modality is the most fragile, (2) existing vision-centric robustness methods do not generalize to other modalities, and (3) diffusion-based action heads (π₀) are inherently more robust than autoregressive ones.", "questions": "1.\tCan you provide quantitative evidence that the flow-matching loss correlates with task success rate (e.g., correlation plots between loss change and success drop)?\n\n2.\tHow is UCB initialized and tuned (α, exploration schedule)? Would uniform or curriculum sampling achieve similar results?\n\n3.\tHow sensitive are the results to the adversarial ε and PGD steps?\n\n4.\tWhile some simple real-world experiments have been conducted, the 17 proposed perturbations have been extensively analyzed primarily in simulations. In real-world robotic manipulation tasks, which perturbations are the primary challenges that urgently need to be addressed, and which can be ignored? For example, the baseline algorithm pi0 can already handle long-horizon, two-arm clothes-folding tasks. Do these 17 perturbations actually exist in such real-world problems?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. 17 perturbations across four modalities, validated on two major VLA backbones and in real-world deployment.\n\n2. The approach is ~50× faster in inference than some vision-robust baselines (e.g., BYOVLA), which is important for real-time robotics.", "weaknesses": "•\tThe use of flow-matching loss as a proxy for action quality is heuristic; correlation with actual task success is assumed but not analyzed quantitatively.\n\n•\tPerformance dependence on ε, PGD steps, λ_in/out, and UCB α is not reported, raising reproducibility concerns.\n\n•\tIt remains unclear how UCB avoids over-fitting to frequently selected perturbations; no ablation against uniform or curriculum sampling is shown.\n\n•\tThe lack of domain randomization method: This method is the most common and effective method in the field of robot learning, but it is missing in this study.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "HDIbbkOYKJ", "reviewer": "Reviewer_jsEV", "summary": "This work evaluates the robustness of VLAs for robotic manipulation and identify the action modality as particularly fragile, in contrast to other modalities (vision, language, etc.) They propose RobustVLA, a framework designed to improve the robustness of VLAs to numerous axes of variation. The core of their method relies on adversarial training and a multi-armed banded (UCB) algorithm to select the most effective input perturbations. Results mostly include evaluations in the LIBERO benchmark, with a modest experimentation in the real-world. Their method achieves improvements relative to baseline models.", "questions": "Clarification of the BYOVLA baseline: the manuscript states that it applies BYOVLA, a visual robustness method, to non-visual perturbations. However, little detail about the implementation is described. My primary concern stems from 1) possible misuse of BYOVLA for other modalities and 2) misuse of BYOVLA as a method. This work states they use a GradCAM (gradient-based attribution method) for BYOVLA but my reading of that paper indicates that the authors therein do not use GradCAM at all in their method. It would be great to provide a detailed description of how BYOVLA was applied to each modality since it was used as a baseline throughout the entire paper. \n\nRationale for small number of fine-tuning demonstrations: related to my previous point, 25 demos is often not enough for VLAs to adapt to a task. It would be great to see how performance of RobustVLA, and the other methods, scale as N increases from 25 up to 100-200. Its very surprising that a model like $\\pi_0$ can't adapt to a FR5 setup.\n\nIs omega time-invariant in Equation 1?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "This paper's mathematical formulation of RobustVLA using the UCB algorithm appears novel and it is a creative application of the multi-armed bandit problem to VLAs. Moreover, the work considers an extensive amount of perturbations (17) and offers improvements in simulation (12% in LIBERO) and real. Moreover, the inference speed is low, which is valuable in robotic applications. \n\nAdditionally, the use of real-world experiments greatly strengthens the paper's claims because LIBERO and other simulation-based approaches often differ substantially from the real-world, limiting generalization of results. By having hardware experiments, there is great confidence in the results presented herein.", "weaknesses": "A minor concern is with the claim that $\\pi_0$ is more robust with diffusion than an action-head; I don't think its tenable to make this claim with only a 5% increase in performance in LIBERO. The margin is too small and the sim-to-real gap is often large enough to make such claims unreliable. I suggest the author's revise this claim and discuss it with more nuance. \n\nAdditionally, while the real-world deployment of your method is commendable, the reliance on a small number of fine-tuning steps makes it difficult to assess the generalization of the results. When fine-tuning VLAs for a specific embodiment, often more than 25 demonstrations are required for good performance. While your approach may confer benefit in the low-data regime, it would be great to see how your method compares to the baselines as the number of demos increases, e.g., N=25, 50, 75, 100. \n\nFinally, another point of contention is the use of the BYOVLA baseline. Upon reading that paper, the authors only use BYOVLA for visual robustness, but your experiments consider it for non-visual modalities as well? In this case, the claim that \"existing visual-robust VLAs do not show improvements in other modalities\" needs revises. I also would suggest framing prior work as a motivation, rather than a result, since BYOVLA never proposed evaluating other modalities such as language or actions. \n\nI also would recommend clarifying that your approach fine-tunes a VLA, and is not a pre-training strategy when turning a VLM into a VLA. \n\nLastly, I would attempt to qualify some statements in Section 3, which only focus on simulation. There is a sim-to-real gap, and without extensive real-world experimentation, it is hard to confidently transfer results from one domain to the other.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)