Robustness came from throwing color away
A Keio University team has shown why a robot vision defense needs a semantic test, not only an attack score. Its FLARE procedure optimized a physical spotlight without access to model internals. In simulation, the selected light drove baseline SmolVLA success from 83.0%, 89.4% and 58.4% to zero across three LIBERO suites, each evaluated over 500 episodes. But the more useful result came after the researchers trained the model with broad color augmentation: the apparent robustness survived because the policy had learned to treat color as noise.[1,2]
The tradeoff appeared on one physical SO-101 arm asked to move either a red or a blue object from the same scene. Baseline SmolVLA succeeded in 31 of 40 benign trials and 11 of 40 attacked trials. Naive augmentation raised attacked success to 16 of 40, yet benign success fell to 19 of 40. ChromaGuard, the team's hue-preserving alternative, reached 39 of 40 benign and 37 of 40 attacked trials. Those counts convert the paper's percentages back into the small denominators behind them.[1]
A grayscale diagnostic supports the mechanism. In simulation, the naively augmented SmolVLA retained 80.1%, 90.5% and 47.8% success on grayscale inputs, close to its 79.4%, 89.8% and 50.2% scores on RGB inputs. The undefended model instead fell to 0%, 10% and 0% in grayscale. Robustness had become color invariance, which is useful only when the task does not require color.[1,4]
Fixing hue preserves the instruction
Naive training perturbed hue, saturation and brightness, so red and blue could cease to be stable labels. ChromaGuard fixes hue while varying saturation, value, contrast and sharpness. That narrower perturbation keeps the color relationship intact while exposing the policy to other lighting changes. The SmolVLA base is designed to accept multiple images, robot state and an optional language instruction, then output continuous actions; its model card also describes it as a base checkpoint meant for task-specific fine-tuning. The paper fine-tuned both bases for 100,000 steps on its own demonstrations rather than evaluating an off-the-shelf deployment.[1,2]
The fix did not transfer cleanly to the second base. On the same 40-trial color task, ChromaGuard's LeRobot pi0.5 base produced 22 benign successes and 28 attacked successes, versus 39 and 37 for SmolVLA. That result is not a test of every component described in the original pi0.5 system: Hugging Face's model card says this base currently supports only the flow-matching action head and excludes upstream components such as subtask prediction, action tokenization and reinforcement learning. The safe conclusion is model-specific: preserving hue repaired this setup strongly for SmolVLA, not uniformly across VLA architectures.[1,3]
One lamp is not a deployment guarantee
The physical evidence covers one arm, two cameras, one scene family and only 20 trials for the color-invariant task and 40 for the two-color task. The researchers generated several attack candidates in simulation and selected the most effective for hardware testing, so the physical result is not a blind or preregistered replication. The paper reports no confidence intervals and explicitly leaves time-varying and adaptive lighting for future work. At review time, no project page, code, trained weights or task data was linked. The arXiv source bundle also contained no supplementary file despite two references to supplementary details.[1,5]
The decision change is therefore a test requirement, not a universal security claim. Integrators using colored bins, parts or indicators should measure whether robustness training preserves those meanings under ordinary light before trusting an improved attack score. The next measurable catalyst is a public artifact release followed by independent, preregistered tests across cameras, robots, color-dependent tasks and dynamic light, with per-condition trial counts and confidence intervals.[1,2,3,5]