Pith. sign in

REVIEW 3 major objections 6 minor 29 references

Structure-Aware Robust Fine-Tuning: Defending Vision-Language-Action Robots Against Physical Attention Hijacking

T0 review · 3 major / 6 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that printable adversarial patches break vision-language-action robot policies by hijacking policy-critical action-to-vision attention, and that a visual-encoder-only fine-tune (SARF) restores robustness with zero inferenc

desk verdict A credible attack/defense pair for VLA patch robustness, with a plausible but under-proven story about attention being the causal mechanism. read the letter →

arxiv 2608.03231 v1 pith:ID4SF467 submitted 2026-08-04 cs.RO cs.AI

Jinquan Zhang , Dongfu Yin , Run Yang , Yufeng Yan , Zhen Tian , F. Richard Yu This is my paper · ORCID
classification cs.ROcs.AI
keywords vision-language-actionmodelsadversarialpatchesphysical-worldattackscross-modalattentionrobustfine-tuningroboticmanipulationExpectationoverTransformationhijacking
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that physically printable adversarial patches break Vision-Language-Action (VLA) robot policies through a specific, locally observable mechanism: action-conditioned cross-attention is pulled away from task-relevant image regions onto the patch. It shows a printable patch optimized under Expectation-over-Transformation, AGSD, can push OpenVLA's failure rate to 100% across LIBERO suites, and that a lightweight defense, SARF, which fine-tunes only the visual encoder while freezing the rest of the policy, cuts that failure rate to a 28.6% average without degrading clean performance. On a real PiPER manipulator, SARF restores average success under a printed AGSD patch from 23.0% to 65.0%. If the mechanism claim is right, stabilizing where the policy looks is a more practical route to physical-world robot safety than global feature alignment alone.

What carries the argument

Attention-guided semantic disruption and policy-critical attention distillation. AGSD's attention-guidance loss $\mathcal{L}_{\mathrm{attn}}$ maximizes the average last-three-layer action-query-to-patch-key attention weight; SARF's policy-critical attention distillation loss $\mathcal{L}_{\mathrm{pcad}}$ minimizes a symmetric Jensen-Shannon divergence between teacher and student action-token attention distributions over visual tokens. The same action-to-vision cross-attention pathway carries both the attack and the defense.

What would settle it

Replace the clean model's last-three-layer action-to-vision attention weights with the AGSD-induced pattern on clean images and run rollouts; if failures do not appear, the measured attention hijacking is not the causal pathway.

Watch

Extended reading notes

Core claim

The central discovery is that action-to-vision attention in a VLA policy is both an attack surface and a defense handle. By maximizing the mean cross-attention weight from action-query tokens to patch-region visual keys over the last three cross-attention layers while also dispersing visual features and misaligning image-text embeddings, AGSD produces patches that transfer across tasks and architectures and drive OpenVLA to 100% failure on LIBERO. SARF then shows the same pathway can be stabilized: distilling the action-token attention distributions of a clean teacher into a student whose visual encoder is fine-tuned restores task-relevant focus, with feature anchoring and language-guided Gr

Load-bearing premise

The load-bearing premise is that the action-to-vision attention shift measured in the last three cross-attention layers is the causal pathway by which a patch breaks the policy—not a symptom of deeper feature corruption—and the argument collapses if attention is only an epiphenomenon even when the failure-rate numbers stand.

Editorial extensions

If this is right

  • If the mechanism is real, future physical attacks on VLA robots should be evaluated by whether they capture action-conditioned attention, not only by global feature distortion.
  • A defense that updates only the visual encoder can confer robustness with zero inference overhead, meaning robust VLA deployment need not add purification or test-time modules.
  • The ablation showing that removing $\mathcal{L}_{\mathrm{pcad}}$ collapses robustness suggests practitioners should prioritize stabilizing policy-critical attention over global representation alignment.
  • SARF's gains hold across UADA, UPA, EDPA, and AGSD patch optimizers, so the benefit is not specific to one patch recipe.
  • Clean-task performance is essentially unchanged on LIBERO (average failure moves from 23.2% to 23.5%), indicating robustness is obtained without sacrificing nominal skill on the evaluated suites.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper's claims, if action-to-vision attention is the causal bottleneck, the same rollout attention statistics could serve as an online safety monitor: a sudden concentration of attention mass on a localized region would flag a possible patch attack before the policy acts.
  • A testable extension, which the paper leaves open, is to identify the analogous policy-critical cross-attention pathway in diffusion- or flow-decoder VLAs and apply the same teacher-student attention distillation there.
  • The paper itself notes that the defense is demonstrated only on OpenVLA and defers third-party adaptive attacks to future work; the stronger causal reading would require independent adaptive attackers who can re-optimize patches against SARF.
  • Because the adaptive AGSD was re-optimized by the same authors, a defense that survives independent adaptive optimization would confirm the mechanism more strongly than self-designed re-optimization can.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes AGSD, an EOT-optimized physical adversarial patch against Vision-Language-Action (VLA) policies, and SARF, a fine-tuning defense that updates only the visual encoder. AGSD's loss (Eq. 3) combines action-to-vision attention guidance (Eq. 4), feature dispersion (Eq. 5), and image-text misalignment (Eq. 6) to induce what the authors call policy-critical action-to-vision attention hijacking. SARF (Eq. 7) uses feature anchoring (Eq. 8), policy-critical attention distillation with Jensen-Shannon divergence (Eq. 9), and language-guided geometric consistency (Eqs. 10-11). Experiments on LIBERO show AGSD drives OpenVLA to 100% failure, while SARF reduces mean failure rate to 28.6% under an adaptive re-optimized AGSD patch and preserves clean performance. Real-robot PiPER experiments show SARF raising success under a printed patch from 23.0% to 65.0%. The paper interprets these results as evidence that stabilizing action-conditioned attention is the causal mechanism underlying both the attack and the defense.

Significance. If the central mechanistic claim is correct, the paper makes a valuable contribution: it gives a transferable physical patch attack that targets a specific policy pathway, and a defense with zero inference overhead that is validated both in simulation and on a real robot. The empirical study is unusually strong in including an adaptive re-optimized attack, multiple attack baselines, a real-robot setup, and ablations showing the attention-distillation term is necessary. However, the causal interpretation that attention hijacking, rather than general feature disruption, is the mechanism is not yet established. The cross-task transfer claim in the abstract is also unsupported by the reported experiments. These issues do not invalidate the empirical results, but they do affect the paper's central explanatory claim and need to be addressed.

major comments (3)
  1. [Sec. IV-C7, Eq. 9, Table IV] The paper's central claim is that 'policy-critical action-to-vision attention hijacking' is the causal failure mechanism, and that SARF's L_pcad is the necessary defense component. The evidence is correlational: AGSD's attention objective increases failure (Fig. 4), attention maps collapse under attack (Fig. 5), and removing L_pcad collapses robustness (Table IV). Because AGSD also perturbs visual features and image-text alignment, and SARF fine-tunes the entire visual encoder with feature anchoring and geometric consistency, the measured attention shifts could be an epiphenomenon of broader feature-space disruption. To support the causal claim, the paper needs an intervention that changes only the attention pathway, e.g., inference-time re-centering of action-to-vision attention on clean features, or a defense variant that explicitly matches only attention while controlling for feature
  2. [Abstract and Sec. IV-B1, Table I] The abstract and introduction claim AGSD yields 'strong cross-task and cross-architecture transfer.' Cross-architecture transfer is supported by Table I (AGSD tested on OpenVLA, OpenVLA-oft, and pi0). Cross-task transfer is not tested: Table I and Fig. 3 evaluate separately optimized patches on each LIBERO suite, not a patch optimized on one task and transferred to another. The paper should either add an experiment where, for example, a patch optimized on LIBERO-Spatial is evaluated on Object/Goal/Long, or remove the cross-task claim from the abstract and introduction.
  3. [Sec. IV-C5 and Sec. V] The adaptive attack used for SARF is a re-optimization of AGSD with the same objective and EOT settings. This is a meaningful step, but the paper defers third-party adaptive attacks to future work. Since the defense's value proposition is robustness against physical attacks that target the same attention pathway, the conclusions should be carefully qualified as 'robust against same-objective adaptive attacks.' The current wording in Sec. V ('a practical and deployable route to securing VLA robots against physical attacks') overstates the evidence without evaluation against attacks that deliberately break the attention-distillation assumption.
minor comments (6)
  1. [Eq. (4)] The text says the attention weights are 'aggregated from the last three cross-attention layers,' but the aggregation (mean over layers, heads, or both) is not specified in the equation. Please define the exact sets and averaging procedure.
  2. [Eq. (6)] The scalar L_misalign uses the notation \| \cdot \|_1, which is confusing for a real-valued scalar. Using an absolute value and explaining that the loss increases the L1 difference between the two similarity scores would be clearer.
  3. [Sec. IV-D, Table III] The real-robot section evaluates patches of sizes 20x20, 15x15, 8x8, and 5x5 cm, but Table III does not state which patch size is used for each task. Please specify this, as the patch-to-task mapping affects the interpretation of the success-rate differences.
  4. [Table IV] The ablation table reports 'only L_pcad' and 'only L_geo' but not 'only L_feat.' The text explains the role of L_feat through the 'w/o L_feat' row, but the 'only' rows are not discussed. A short explanation of why the single-component variants behave as they do would help.
  5. [Sec. IV-A6] The loss coefficients for AGSD and SARF are hand-set, and no sensitivity analysis or ablation over coefficient values is reported. At minimum, provide a small study showing that the main results are stable to perturbation of lambda_attn, lambda_pcad, and lambda_geo.
  6. [Sec. IV-A2] The evaluation includes OpenVLA-oft and pi0, but the text does not specify the exact checkpoints, fine-tuning protocols, or action decoding settings used for these models. Please add these details to enable reproducibility.

Circularity Check

1 steps flagged · score 2.0 of 10

No load-bearing circularity: the attack/defense comparisons are self-contained; the only mild self-definitional element is using the optimized attention quantity as evidence for the attention-hijacking mechanism.

  1. self definitional [Eq. (4) and Sec. IV-B.4]
    "Under AGSD, the Original policy’s action-to-vision attention repeatedly collapses onto the patch region across rollout timesteps, diverting focus away from task-relevant evidence. This motivates defenses that explicitly stabilize policy-critical attention pathways."

    The observed collapse is exactly the quantity AGSD is optimized to maximize: Eq. (4) defines L_attn as the negative mean cross-attention from action queries to patch keys, so minimizing L_AGSD increases that attention by construction. Reporting attention collapse after AGSD is therefore a sanity check of the optimization, not independent evidence that the attention shift (rather than the concurrent semantic disruption L_disp/L_misalign) is the causal driver of failure. Similarly, SARF’s re-centering of attention is a direct effect of L_pcad (Eq. 9), which distills student attention to the clean teacher. The empirical failure-rate reductions are independent, but this particular mechanism-level confirmation is partly definitional.

full rationale

The paper’s central quantitative claims—AGSD’s high failure rates and SARF’s robustness improvements—are evaluated against external baselines (UADA, UPA, EDPA, random patches, clean) and an adaptive re-optimized AGSD patch, with real-robot validation on PiPER. The loss coefficients in Eqs. (3) and (7) are hand-selected hyperparameters, not parameters fitted to the predicted outcome; no derivation reduces to a fitted value. The only self-citations, refs. [13] and [14], appear in related-work context and are not load-bearing. The mild self-definitional issue is that the paper’s mechanism-level evidence partly re-reads the optimized objective: L_attn (Eq. 4) forces attention onto the patch, and L_pcad (Eq. 9) forces attention back to the teacher, so the corresponding heatmap changes are expected from the loss design. This does not invalidate the independent failure-rate results, but it means the causal claim that last-three-layer action-to-vision attention is the policy-critical pathway is asserted rather than independently demonstrated. The paper also acknowledges remaining limitations—deferring third-party adaptive attacks and extension to diffusion/flow decoders—which further supports treating the mechanism claim as provisional. Overall, the core attack/defense comparisons are self-contained; the circularity score is low.

Assumptions & free parameters 6 free parameters · 4 assumptions · 1 invented entities

The central claim depends on a causal interpretation of attention (domain assumption), on hand-set loss weights and EOT parameters, and on the teacher-stream mask. These are not fitted to the failure-rate outcome, but they are necessary for the mechanism narrative. No new physical entities are posited; the named 'hijacking' is a conceptual mechanism without independent external evidence.

free parameters (6)
  • AGSD loss weights = lambda_attn=0.8, lambda_disp=0.2, lambda_misalign=0.5
    Hand-selected in Section IV-A6 to balance gradient magnitudes; not fit to outcome.
  • SARF loss weights = lambda_feat=0.5, lambda_pcad=1.0, lambda_geo=0.3
    Hand-selected in Section IV-A6; prioritizes attention distillation.
  • EOT transformation ranges = rotation +/-30 deg, translation 10%, scale 0.9-1.1, etc.
    Chosen physical-variation model; not fit from data.
  • Patch size (LIBERO) = 5% of image area
    Fixed protocol matching prior patch attacks.
  • PiPER patch sizes = 20x20, 15x15, 8x8, 5x5 cm
    Real-world sizes chosen to test scale sensitivity.
  • Temperatures tau_nce, tau_attn = not specified
    Appear in Eq. 5 and Eq. 9 but no values are given; reproducibility gap.
assumptions (4)
  • domain assumption The last three cross-attention layers' attention from action-query tokens to visual tokens is the policy-critical pathway that determines VLA actions.
    Used to define L_attn (Eq. 4) and L_pcad (Eq. 9); if false, the mechanism narrative and defense design are unsupported.
  • domain assumption A clean teacher's text-to-vision attention reliably identifies task-relevant regions for the geometric mask M.
    M is built from teacher attention (Section IV-B) and used to restrict L_geo (Eq. 10).
  • domain assumption Fine-tuning only the visual encoder preserves language grounding and action-head behavior.
    Central to SARF's zero-overhead design; empirically checked in Table II clean row.
  • domain assumption The EOT distribution used in optimization matches real-world variations on PiPER.
    Needed for sim-to-real transfer of AGSD patches and SARF robustness.
invented entities (1)
  • Policy-critical action-to-vision attention hijacking
    purpose: Named failure mechanism that explains why physical patches degrade VLA control and motivates the attack and defense design.
    Supported only by in-paper attention maps (Fig. 5) and ablations (Table IV, Fig. 4); no external falsifiable handle is given.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Structure-Aware Robust Fine-Tuning: Defending Vision-Language-Action Robots Against Physical Attention Hijacking." pith.science (2026). https://pith.science/paper/ID4SF467

@misc{pith2026260803231,
  author       = {Pith},
  title        = {Pith review of: Structure-Aware Robust Fine-Tuning: Defending Vision-Language-Action Robots Against Physical Attention Hijacking},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ID4SF467}},
  note         = {Machine review of arXiv:2608.03231}
}
read the original abstract

Vision-Language-Action (VLA) policies promise general robotic manipulation, but their robustness against physical-world attacks remains fragile. In particular, we show that physically realizable adversarial patches can reliably induce failures by triggering a mechanism we call policy-critical action-to-vision attention hijacking, where action-conditioned attention is diverted from task-relevant regions to a localized patch. To demonstrate the threat, we propose Attention-Guided Semantic Disruption (AGSD), an Expectation-over-Transformation (EOT) optimized printable patch that jointly (i) concentrates action-to-vision attention on the patch and (ii) disrupts vision-language semantic alignment, yielding strong cross-task and cross-architecture transfer. To mitigate such attacks, we introduce Structure-Aware Robust Fine-Tuning (SARF), a zero-inference-overhead defense that fine-tunes only the visual encoder using feature anchoring, policy-critical attention correction, and language-guided geometric consistency restricted to semantically relevant regions. On LIBERO, SARF reduces OpenVLA's failure rate under AGSD from 100% to 14.2%-56.8% (28.6% average) across suites while preserving clean performance, and on a real PiPER manipulator it improves average success under AGSD from 23.0% to 65.0%. These results highlight mechanism-level robustness as a practical path to securing VLA robots against physical attention hijacking.

Figures

Figures reproduced from arXiv: 2608.03231 by the authors.

Figure 1
Figure 1. Motivation and overview of SARF against physical attention hijacking. [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Physical attention hijacking and our attack–defense pipeline. (a) A VLA policy encodes an RGB observation [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Printable AGSD patch examples. Representative AGSD patches [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: AGSD hijacks policy-critical attention, while SARF restores task [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Real-robot qualitative comparison under physical patch attacks (PiPER [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

29 extracted references · 13 canonical work pages

  1. [1]

    Rt-2: Vision-language-action models transfer web knowledge to robotic control,

    B. Zitkovich, T. Yu, S. Xu,et al., “Rt-2: Vision-language-action models transfer web knowledge to robotic control,” inConference on Robot Learning. PMLR, 2023, pp. 2165–2183

    work page 2023

  2. [2]

    Openvla: An open-source vision-language-action model,

    M. J. Kim, K. Pertsch, S. Karamcheti,et al., “Openvla: An open-source vision-language-action model,”arXiv preprint arXiv:2406.09246, 2024

    arXiv 2024

  3. [3]

    Octo: An open-source generalist robot policy,

    O. M. Team, D. Ghosh, H. Walke,et al., “Octo: An open-source generalist robot policy,”arXiv preprint arXiv:2405.12213, 2024

    arXiv 2024

  4. [4]

    π 0: A vision-language-action flow model for general robot control,

    K. Black, N. Brown, D. Driess,et al., “π 0: A vision-language-action flow model for general robot control,”arXiv preprint arXiv:2410.24164, 2024

    arXiv 2024

  5. [5]

    Adversarial patch,

    T. B. Brown, D. Mané, A. Roy,et al., “Adversarial patch,”arXiv preprint arXiv:1712.09665, 2017

    arXiv 2017

  6. [6]

    Synthesizing robust adversar- ial examples,

    A. Athalye, L. Engstrom, A. Ilyas,et al., “Synthesizing robust adversar- ial examples,” inInternational conference on machine learning. PMLR, 2018, pp. 284–293

    work page 2018

  7. [7]

    Manipulation facing threats: Evaluating physical vulnerabilities in end-to-end vision language action models,

    H. Cheng, E. Xiao, Y . Wang,et al., “Manipulation facing threats: Evaluating physical vulnerabilities in end-to-end vision language action models,”arXiv preprint arXiv:2409.13174, 2024

    arXiv 2024

  8. [8]

    Eva-vla: Evaluating vision-language- action models’ robustness under real-world physical variations,

    H. Liu, J. Long, J. Wu,et al., “Eva-vla: Evaluating vision-language- action models’ robustness under real-world physical variations,”arXiv preprint arXiv:2509.18953, 2025

    arXiv 2025

Show all 29 references
  1. [9]

    Exploring the adversarial vulnera- bilities of vision-language-action models in robotics,

    T. Wang, C. Han, J. Liang,et al., “Exploring the adversarial vulnera- bilities of vision-language-action models in robotics,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2025, pp. 6948–6958

    2025

  2. [10]

    Model-agnostic adversarial attack and defense for vision-language-action models,

    H. Xu, Y . S. Koh, S. Huang,et al., “Model-agnostic adversarial attack and defense for vision-language-action models,”arXiv preprint arXiv:2510.13237, 2025

    2025

  3. [11]

    Libero: Benchmarking knowledge transfer for lifelong robot learning,

    B. Liu, Y . Zhu, C. Gao,et al., “Libero: Benchmarking knowledge transfer for lifelong robot learning,”Advances in Neural Information Processing Systems, vol. 36, pp. 44 776–44 791, 2023

    2023

  4. [12]

    Diffusion policy: Visuomotor policy learning via action diffusion,

    C. Chi, Z. Xu, S. Feng,et al., “Diffusion policy: Visuomotor policy learning via action diffusion,”The International Journal of Robotics Research, vol. 44, no. 10-11, pp. 1684–1704, 2025

    2025

  5. [13]

    Mft: Modal fusion transformer for cross- modal fusion in 3d object detection,

    H. Cai, D. Yin, F. Yu,et al., “Mft: Modal fusion transformer for cross- modal fusion in 3d object detection,” inICASSP 2025–2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2025, pp. 1–5

    2025

  6. [14]

    Dstr: Dual scenes transformer for cross-modal fusion in 3d object detection,

    H. Cai, D. Yin, F. R. Yu,et al., “Dstr: Dual scenes transformer for cross-modal fusion in 3d object detection,” in2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV). IEEE, 2025, pp. 3064–3073

    2025

  7. [15]

    When robots obey the patch: Universal transferable patch attacks on vision-language-action models,

    H. Lu, Y . Yu, Y . Yang,et al., “When robots obey the patch: Universal transferable patch attacks on vision-language-action models,”arXiv preprint arXiv:2511.21192, 2025

    2025

  8. [16]

    Attention-guided patch-wise sparse adversarial attacks on vision-language-action models,

    N. Zhang, W. Tao, X. Xiao,et al., “Attention-guided patch-wise sparse adversarial attacks on vision-language-action models,”arXiv preprint arXiv:2511.21663, 2025

    2025

  9. [17]

    Attackvla: Benchmarking adversarial and backdoor attacks on vision-language-action models,

    J. Li, Y . Zhao, X. Zheng,et al., “Attackvla: Benchmarking adversarial and backdoor attacks on vision-language-action models,”arXiv preprint arXiv:2511.12149, 2025

    2025

  10. [18]

    Towards deep learning mod- els resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt,et al., “Towards deep learning mod- els resistant to adversarial attacks,”arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  11. [19]

    Theoretically principled trade-off be- tween robustness and accuracy,

    H. Zhang, Y . Yu, J. Jiao,et al., “Theoretically principled trade-off be- tween robustness and accuracy,” inInternational conference on machine learning. PMLR, 2019, pp. 7472–7482

    2019

  12. [20]

    Domain randomization for transferring deep neural networks from simulation to the real world,

    J. Tobin, R. Fong, A. Ray,et al., “Domain randomization for transferring deep neural networks from simulation to the real world,” in2017 IEEE/RSJ international conference on intelligent robots and systems (IROS). IEEE, 2017, pp. 23–30

    2017

  13. [21]

    Diffusion models for adversarial purification,

    W. Nie, B. Guo, Y . Huang,et al., “Diffusion models for adversarial purification,”arXiv preprint arXiv:2205.07460, 2022

    2022 arXiv

  14. [22]

    Defense-gan: Protecting classifiers against adversarial attacks using generative models,

    P. Samangouei, M. Kabkab, and R. Chellappa, “Defense-gan: Protecting classifiers against adversarial attacks using generative models,”arXiv preprint arXiv:1805.06605, 2018

    2018 arXiv

  15. [23]

    Pixeldefend: Leveraging generative models to understand and defend against adversarial examples,

    Y . Song, T. Kim, S. Nowozin,et al., “Pixeldefend: Leveraging generative models to understand and defend against adversarial examples,”arXiv preprint arXiv:1710.10766, 2017

    2017 arXiv

  16. [24]

    {PatchGuard}: A provably robust defense against adversarial patches via small receptive fields and masking,

    C. Xiang, A. N. Bhagoji, V . Sehwag,et al., “{PatchGuard}: A provably robust defense against adversarial patches via small receptive fields and masking,” in30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 2237–2254

    2021

  17. [25]

    Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,

    A. Athalye, N. Carlini, and D. Wagner, “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,” inInternational conference on machine learning. PMLR, 2018, pp. 274–283

    2018

  18. [26]

    Overcoming catas- trophic forgetting in neural networks,

    J. Kirkpatrick, R. Pascanu, N. Rabinowitz,et al., “Overcoming catas- trophic forgetting in neural networks,”Proceedings of the national academy of sciences, vol. 114, no. 13, pp. 3521–3526, 2017

    2017

  19. [27]

    Learning without forgetting,

    Z. Li and D. Hoiem, “Learning without forgetting,”IEEE transactions on pattern analysis and machine intelligence, vol. 40, no. 12, pp. 2935– 2947, 2018

    2018

  20. [28]

    Paying more attention to attention: Improving the performance of convolutional neural networks via atten- tion transfer,

    S. Zagoruyko and N. Komodakis, “Paying more attention to attention: Improving the performance of convolutional neural networks via atten- tion transfer,”arXiv preprint arXiv:1612.03928, 2016

    2016 arXiv

  21. [29]

    Robust finetuning of vision- language-action robot policies via parameter merging,

    Y . Yadav, Z. Zhou, A. Wagenmaker,et al., “Robust finetuning of vision- language-action robot policies via parameter merging,”arXiv preprint arXiv:2512.08333, 2025

    2025

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.