Abstract

Quantized Vision-Language-Action (VLA) models expose a weight-fault surface: Rowhammer-style faults can corrupt deployed INT8 bits. We present the first bit-flip attack on a VLA: a few gradient-selected flips reduce closed-loop success to 0%, while hundreds of random flips are harmless. Across four model variants spanning three action-head families, damaging bits concentrate in a few action-generating layers, but the empirical budget depends sharply on the head: direct regression and token policies fall in 15 flips, whereas the evaluated flow-matching policies require __ 100300. Our fixeddirection manifold-escape loss cuts __ 0s budget from __ 1000 to __ 100 flips, and a matched five-direction sweep shows that the attack is not specific to an all-positive direction. On a direct head, protecting 3 _._ 1% of weights preserves 60% success at _K_ =100, and protecting 5 _._ 3% moves the open-loop break threshold from 3 to 100 flips. Finally, task-calibrated emulated _K_ =100 flips yield 0 _/_ 20 real-robot successes, versus 14 _/_ 20 clean and 16 _/_ 20 global-random. Weight integrity is therefore a security boundary for embodied foundation models. Code is included as ancillary material.