DRIFT attacks flow-matching policies in a digital robot benchmark
The evaluated patch is a simulated wrist-camera input, optimized with 500 PGD iterations; the study is not a printed physical-world trial.
DRIFT’s first arXiv submission is August 4, 2026. The original August 9 article incorrectly said it arrived on August 29. The research attacks the first denoising step of flow-matching vision-language-action policies, including pi0 and pi0.5, in LIBERO.
Section 5 describes digital wrist-camera patches: Table 2 uses 32-by-32 pixels for pi0 and 64-by-64 pixels for pi0.5. Section 5.2 uses 500 projected-gradient-descent iterations, not fewer than 40. The checked experiment does not describe printing the patch and conducting a physical-world robot trial.
Attack success is evaluated against the study’s tested policies and originally solvable tasks. It does not establish a guaranteed attack on every robot or prove that swapping any model cannot mitigate the issue.
The experiment is a reason to test adversarial visual inputs at the policy boundary. Physical deployment requires a separate evaluation of patch delivery, perception, hardware and closed-loop behavior.
Editorial correction (2026-10-13 UTC): Corrected the source date, iteration budget and digital threat model.