By integrating Chain-of-Thought(CoT) reasoning, Vision-Language-Action (VLA) models have demonstrated strong capabilities in robotic manipulation, particularly by improving generalization and interpretability. However, the security of CoT-based reasoning mechanisms remains largely unexplored. In this paper, we show that CoT reasoning introduces a novel attack vector for targeted control hijacking--for example, causing a robot to mistakenly deliver a knife to a person instead of an apple--without modifying the user's instruction. We first provide empirical evidence that CoT strongly governs action generation, even when it is semantically misaligned with the input instructions. Building on this observation, we propose TRAP, the first targeted adversarial attack framework for CoT-reasoning VLA models. TRAP uses an adversarial patch (e.g., a coaster placed on the table) to corrupt intermediate CoT reasoning and hijack the VLA's output. By optimizing the CoT adversarial loss, TRAP induces specific and adversary-defined behaviors. Extensive evaluations across 3 mainstream VLA architectures and 3 CoT reasoning paradigms validate the effectiveness of TRAP. Notably, we implemented the patch by printing it on paper in a real-world setting. Our findings highlight the urgent need to secure CoT reasoning in VLA systems.

翻译：摘要：通过整合思维链推理，视觉-语言-动作模型在机器人操作中展现了强大的能力，特别是在提升泛化性和可解释性方面。然而，基于CoT的推理机制的安全性仍鲜有探索。本文证明，CoT推理引入了一种新型攻击向量，可实现针对性控制劫持——例如，无需修改用户指令即可使机器人误将刀具递给人类而非苹果。我们首先通过实证表明，即使CoT推理与输入指令在语义上不一致，它仍强烈主导动作生成。基于这一发现，我们提出了TRAP——首个针对CoT推理型VLA模型的目标性对抗攻击框架。TRAP利用对抗性补丁（例如放置在桌面上的杯垫）破坏中间CoT推理，从而劫持VLA的输出。通过优化CoT对抗损失，TRAP能诱发特定且由攻击者定义的行为。在3种主流VLA架构和3种CoT推理范式上的广泛评估验证了TRAP的有效性。值得注意的是，我们在真实场景中通过将补丁打印在纸上进行了实现。我们的研究结果凸显了保障VLA系统中CoT推理安全的迫切性。