The real-world deployment of Vision-Language-Action (VLA) models remains limited by the risk of unpredictable and irreversible physical harm. However, we currently lack effective mechanisms to proactively detect these physical safety risks before deployment. To address this gap, we propose \textbf{RedVLA}, the first red teaming framework for physical safety in VLA models. We systematically uncover unsafe behaviors through a two-stage process: (I) \textbf{Risk Scenario Synthesis} constructs a valid and task-feasible initial risk scene. Specifically, it identifies critical interaction regions from benign trajectories and positions the risk factor within these regions, aiming to entangle it with the VLA's execution flow and elicit a target unsafe behavior. (II) \textbf{Risk Amplification} ensures stable elicitation across heterogeneous models. It iteratively refines the risk factor state through gradient-free optimization guided by trajectory features. Experiments on six representative VLA models show that RedVLA uncovers diverse unsafe behaviors and achieves the ASR up to 95.5\% within 10 optimization iterations. To mitigate these risks, we further propose SimpleVLA-Guard, a lightweight safety guard built from RedVLA-generated data. Our data, assets, and code are available \href{https://redvla.github.io}{here}.

翻译：视觉-语言-动作（Vision-Language-Action, VLA）模型在实际部署中仍受限于不可预测且不可逆的物理伤害风险。然而，目前缺乏有效的机制在部署前主动检测这些物理安全风险。为填补这一空白，我们提出 **RedVLA**——首个针对VLA模型物理安全性的红队测试框架。我们通过两阶段流程系统性地揭示不安全行为：（I）**风险场景合成** 构建有效且任务可行的初始风险场景。具体而言，它从正常轨迹中识别关键交互区域，并将风险因素定位在这些区域内，旨在使其与VLA的执行流程纠缠，从而诱发目标不安全行为。（II）**风险放大** 确保跨异构模型的稳定诱发。它通过基于轨迹特征的无梯度优化，迭代优化风险因素状态。对六个代表性VLA模型的实验表明，RedVLA能揭示多种不安全行为，并在10次优化迭代内实现高达95.5%的攻击成功率（ASR）。为缓解这些风险，我们进一步提出SimpleVLA-Guard——一种基于RedVLA生成数据构建的轻量级安全防护机制。我们的数据集、资产和代码可在此处获取。