Vision-language-action (VLA) policies bring natural language into closed-loop robot control, enabling robots to execute manipulation tasks directly from text instructions. The same interface gives text a recurring role in control because the prompt is reused at every replanning step, and each prompt-conditioned action changes the future observations on which the policy acts. Existing VLA attacks study adversarial prompts that elicit targeted low-level actions or make such actions persist across changing images. We identify a stronger trajectory-level failure mode: a prompt that still $\textit{appears}$ to specify the intended task but redirects the final physical outcome. We mathematically formalize this setting as $\textit{command-preserving trajectory redirection}$, a prompt-only threat model in which the attacker chooses one prompt before the episode, all policy and environment components remain fixed, and the prompt must stay close to the benign instruction while omitting target words and correction language. To find such prompts, we introduce an on-policy prompt search method that uses rollouts to discover perturbations whose closed-loop behavior tracks a target task while satisfying the command-preserving constraints. Experiments in simulation and on hardware show that near-benign prompt perturbations can redirect VLA rollouts to attacker-specified targets. These results expose a trajectory-level vulnerability in VLA instruction grounding: text that appears to preserve the intended command can still give an adversary control over the robot's final physical outcome. Project website: https://vla-redirection-attack.github.io/

翻译：视觉-语言-动作（VLA）策略将自然语言引入闭环机器人控制，使机器人能够直接根据文本指令执行操作任务。由于指令提示在每个重新规划步骤中重复使用，且每个基于提示的动作会改变策略后续依赖的观测数据，因此这种接口赋予了文本在控制中的持续作用。现有VLA攻击研究针对能诱发生成特定低级动作的对抗性提示，或使此类动作在图像变化中持续存在。我们识别出一种更强的轨迹级故障模式：提示$\textit{看似}$指定了预期任务，但实际重定向了最终物理结果。我们将该场景数学形式化为$\textit{指令保持的轨迹重定向}$——一种仅依赖提示的威胁模型，其中攻击者可在回合开始前选择一个提示，所有策略与环境组件保持固定，且提示必须接近良性指令，同时避免目标词汇和修正性语言。为寻找此类提示，我们提出一种基于策略的提示搜索方法，通过轨迹回滚发现满足指令保持约束、且闭环行为跟踪目标任务的扰动。仿真与硬件实验表明，接近良性的提示扰动可将VLA轨迹回重定向至攻击者指定的目标。这些结果揭示了VLA指令理解中的轨迹级漏洞：看似保留原始指令的文本仍可能使攻击者控制机器人的最终物理结果。项目网站：https://vla-redirection-attack.github.io/