Robustness evaluation method of visual language action model in changing scene

Abstract

The invention relates to the field of robot control and decision models, and discloses a robustness evaluation method of a visual language motion model in a changing scene. Aiming at the problems that an existing evaluation method is single in disturbance, cannot be physically realized and depends on white box information, the method converts object three-dimensional transformation, illumination variation and adversarial patches into a continuous parameter space, realizes worst scene search in a black box environment by adopting a CMA-ES algorithm, and constructs a simulation-evaluation integrated framework. And the model robustness system test is realized by unifying the task benchmark and the quantitative index. Gradient information is not needed, automatic execution can be achieved, and the result can be physically verified. The method is suitable for safety verification and robustness testing of various visual language action models, and provides technical support for reliable deployment of a robot system in the fields of manufacturing, medical treatment and service.

Description

Technical Field

[0001] This invention relates to the field of intelligent robot control and decision-making, and in particular to a method for evaluating the robustness of visual language action models under physical changes. Background Technology

[0002] In recent years, with the development of large-scale visual-language models (VLMs) and large language models (LLMs), visual-language-action models (VLAs) have become an important research direction in the field of robot intelligent control. VLA models integrate visual perception, language understanding, and motion planning capabilities, enabling robots to automatically execute complex operations based on natural language commands. For example, in manufacturing, robots complete assembly based on commands such as "put the red part into the box on the left"; in the medical field, surgical robotic arms can understand doctors' language and perform instrument delivery actions; in service robots, systems complete tasks such as picking, placing, sorting, and cleaning through voice commands. Representative research includes models such as RT-2 (Google DeepMind), the OpenVLA series (Stanford & CMU), CogACT, SpatialVLA, and TraceVLA. These models signify that robot control is evolving from the traditional "geometry and rule-based" approach to one based on "perception and language understanding."

[0003] However, while VLA performs excellently in standardized simulation tasks, its stability in real-world physical environments falls far short of industrial-grade requirements. Slight changes in the scene (such as object position shifts, lighting variations, or local texture occlusion) can cause catastrophic error outputs, leading to task failure or even dangerous behavior. Some research has attempted to explore model robustness through adversarial example generation.

[0004] Its exploration is mainly divided into the following categories: (1) Gradient-based adversarial attack methods. Reference [3] proposed white-box attack algorithms such as FGSM (Fast Gradient Sign Method), which generate adversarial examples by calculating the loss function and the gradient of the input image. Reference [4] extended this method to the robot visual perception system, and induced the model to produce erroneous output by injecting imperceptible noise into the image. However, this type of method has two limitations. First, it relies on the gradient information inside the model and cannot be applied to closed-source VLA systems. Second, the generated pixel-level perturbation is difficult to realize in the physical world, and the evaluation results are biased from the actual deployment scenario. (2) Adversarial patch technology. Reference [5] proposed to place patches with specific patterns in the physical scene to attack the target detection system. Reference [6] applied this idea to the robot grasping scenario and made the robot recognize the wrong by optimizing the patch texture. Although this method has physical feasibility, it only focuses on a single perturbation type at the visual level and does not consider the influence of spatial transformation and illumination change, making it difficult to fully reflect the complexity of the real scene. (3) Random disturbance test in simulation environment. Reference [7] tests the stability of the model by randomly adjusting parameters such as the position of the object and the intensity of the light in the simulator. However, this method adopts a random sampling strategy and cannot systematically find the most vulnerable "worst scenario" of the model. The evaluation efficiency is low and the results lack specificity.

[0005] In summary, existing VLA robustness evaluation methods suffer from three key shortcomings: ① Limited perturbation types: focusing only on single perturbations at the visual or spatial levels, lacking a comprehensive evaluation of multiple physical changes; ② Physically unrealizable: gradient-based pixel perturbations do not conform to real-world physical laws, making them difficult to deploy in real-world environments and limiting the engineering value of the evaluation results; ③ White-box dependency: requiring access to internal model gradients or feature layer information, making them incompatible with current mainstream closed-source VLA systems and non-differentiable simulation platforms. Therefore, there is an urgent need to establish a robustness evaluation method that unifies the modeling of multiple physical changes, is applicable to black-box scenarios, can automatically search for worst-case scenarios, and whose results are physically verifiable. Summary of the Invention

[0006] (a) Technical problems to be solved This invention aims to address the problems of limited perturbation types, physical unrealizability, and white-box dependency in existing robustness assessment methods. It provides an automated, generalizable, and reproducible robustness assessment method for visual language action models, systematically evaluating the stability and failure patterns of the models under complex physical changes.

[0007] (II) Technical Solution To address the aforementioned issues, this invention proposes a robustness evaluation method for visual language action models in changing scenarios. The core idea is to transform discrete physical changes into a continuous parameter optimization problem, employing a gradient-free optimization algorithm to automatically search for the worst-case scenario under black-box conditions, and constructing a unified evaluation benchmark for quantitative analysis. The specific technical solution is as follows: Continuous parametric modeling of S1 physical changes As shown in Figure 1, discrete physical perturbations in the real world, such as changes in light source position, object orientation rotation, and patch position offset, are uniformly mapped into a parameterizable continuous variation space. This parameterization is achieved through mathematical modeling, ensuring the controllability and repeatability of the evaluation process, and that all parameters satisfy physical rationality constraints. Specifically, this includes three types of transformations: S11 Object 3D Transformation: Uses rotation parameters α, β, and γ to describe the pose changes of an object in space; S12 Illumination Variation: Based on the Gaussian attenuation model L(z) = I·exp( ||z (x,y)||² / 2σ²) simulates the distribution of the light source, with parameters including the light source intensity I, position (x,y), and attenuation coefficient σ; S13 Adversarial Patch: Uses positional parameters (x, y) to control the position and extent of the patch within the desktop texture.

[0008] S2 Black-box Optimized Search Based on CMA-ES As shown in Figure 2, the Covariance Matrix Adaptive Evolutionary Strategy (CMA-ES) is used as the core optimization engine. The key advantages of this algorithm are that it requires no gradient information, is suitable for black-box VLA systems, adaptively learns covariance, efficiently explores high-dimensional parameter spaces, and is robust to non-convex and non-smooth objective functions. The specific process includes: S21 Initialization phase: Set the initial mean μ0 and covariance matrix C0 of the parameter space; S22 Sampling Phase: Sample N candidate perturbation parameter sets from the current distribution N(μ,C), where N is not less than 20; S23 Evaluation Phase: Apply each set of parameters to the simulation environment, render the current frame image, input the current frame image into the visual language action model for inference, and calculate the adversarial loss as the fitness function value, where the adversarial loss is set as the cosine similarity between the currently output action vector and the action vector output from the original scene; S24 Selection Phase: Select the individual with the best fitness from N candidate solutions and update the distribution parameter (μ). t+1 C t+1 The search direction and step size are adaptively adjusted. The optimal solution should ensure that the cosine similarity is minimized, that is, the current action is as inconsistent as possible with the original action. S25 Iterative Convergence: Repeat the above process until the "worst-case scenario" perturbation configuration that results in the highest failure rate of the model is found.

[0009] S3 Unified Assessment Benchmark and Task System Construction Based on the LIBERO simulation dataset, batch evaluation tasks covering four categories—space tasks, object tasks, target tasks, and long-duration tasks—are designed. Each task includes original natural language instructions, corresponding scene configuration files, object attributes, and action sequence labels. By testing different types of physical changes and model architectures on a unified task set, fair and comparable robust evaluation results can be obtained. The entire process can be automatically executed in the simulation environment (MuJoCo) used for the Libero dataset: extracting updatable parameters from the original configuration files; generating physical transformations using CMA-ES; rendering images and inputting them into the VLA model; obtaining motion control vectors; controlling the robotic arm to perform the task and recording the success rate. The entire process requires no manual intervention, achieving automated evaluation and batch testing, significantly improving experimental efficiency and result reproducibility. Taking the control of the robotic arm as an example, the specific process is as follows: Figure 3 As shown: S31 extracts a specific task from the dataset. This task includes a corresponding task configuration file and natural language instructions. The language instructions include task descriptions such as "put the bowl in the plate". Initialize parameters and use an evolutionary strategy algorithm to update different parameters for three different transformations. Specifically, the target 3D transformation updates the 3D pose of the key target, the lighting transformation updates the lighting distribution in the scene, and the adversarial patch updates its planar position on the desktop texture by translation. All three transformations are updated by converting them into parameterized methods.

[0010] The updated S32 configuration file is input into the simulator to render the current frame image; S33 inputs the current frame image and natural language instructions into the visual language action model to obtain the action control vector; S34 inputs the motion control vector output in S33 into the simulator to perform operations such as grasping, moving, and placing on the robotic arm, thus executing the target behavior. S35 iterates until the task fails or the maximum number of iterations is reached.

[0011] S36 Robustness evaluation results are generated by recording the model's task completion status in N independent runs under a specified physics transformation type (3D transformation / lighting transformation / adversarial patch). The success rate (SR) is calculated as follows: SR = (number of successful task completions) / (total number of tests) × 100%. Simultaneously, the robustness index (RI) is calculated: RI = 1 - (worst-case success rate / original-case success rate). A RI value closer to 0 indicates a more robust model; a RI value closer to 1 indicates severe performance degradation under physics changes.

[0012] (III) Beneficial Effects Compared with the prior art, the beneficial effects of the present invention include: 1. This invention comprehensively evaluates multiple types of physical changes through unified parametric modeling, and can continuously simulate complex real-world scenes with large sample sizes, covering three types of physical disturbances: space, lighting, and texture. It solves the problem of the single type of disturbance in existing methods and is more in line with the complexity of real-world scenes. 2. All parameterized perturbations in this invention are designed based on physical rationality constraints, and the generated changes can be deployed in a real environment, resulting in high engineering application value of the evaluation results; 3. This invention employs the gradient-free optimization algorithm CMA-ES, which does not require access to the model's internal gradient information, making it suitable for closed-source systems and non-differentiable simulation platforms, and thus has a wide range of applications. 4. This invention constructs an integrated simulation-evaluation framework, which can complete batch testing without manual intervention, improving experimental efficiency and result repeatability; 5. This invention provides unified success rate (SR) and robustness index (RI) to facilitate fair comparison and quantitative analysis of different models and tasks. Attached Figure Description

[0013] Figure 1 is a schematic diagram of converting discrete physical changes into continuous parameter optimization; Figure 2 shows the black-box optimization framework based on the covariance matrix adaptive evolution strategy; Figure 3 is the overall flowchart; Figure 4 This is a schematic diagram of the target 3D transformation in an embodiment of the present invention; Figure 5 This is a schematic diagram of illumination transformation according to an embodiment of the present invention; Figure 6 This is a schematic diagram illustrating the anti-patch mechanism in an embodiment of the present invention. Detailed Implementation

[0014] This embodiment provides a specific implementation process for a method to evaluate the robustness of a visual language action model in changing scenarios. Taking the evaluation of the target 3D transformation robustness of a visual language action model in the task of "turning on the stove and putting the moka pot on it" as an example, it is explained in detail.

[0015] Step S1: Parametric modeling of the target 3D transformation scene S11: As Figure 4 As shown, the 3D transformation of the real-world target is first parametrically modeled. In this embodiment, for the task "turn on the stove and put the moka pot on it" in the LIBERO dataset, the target object (stove) in the scene is selected as the transformation object, and its pose transformation parameters in three-dimensional space are defined. Specifically, Euler angle notation is used, and three rotation parameters are set: rotation angle α around the X-axis, rotation angle β around the Y-axis, and rotation angle γ around the Z-axis. The X-axis is set to face the camera and be parallel to the table as the positive direction, and this coordinate system follows the right-hand rule. In this embodiment, the initial parameters are set to α0=0°, β0=0°, and γ0=0°, indicating that the stove is in a normal placement posture. The search range of the parameters for this task is set to γ∈[-180°, 180°], while the other two angles remain unchanged to ensure that the pose transformation is physically reasonable (e.g., the stove will not be embedded in the table).

[0016] S12: As Figure 3 As shown, we first perform parametric modeling of lighting changes in the real world. For the task "Take the black bowl from the top drawer of the cabinet and place it on a plate" in the LIBERO dataset, a Gaussian attenuation model is used to simulate the distribution changes of point light sources in the scene. Specifically, the light intensity function is defined as: L(z) = I·exp(-||z-(x,y)||² / 2σ²), where I is the light source intensity parameter, (x,y) is the position coordinate of the light source in the scene space, σ is the attenuation coefficient, and z is the coordinate of any point in the scene. In this embodiment, the initial light source parameters are set as follows: intensity I0 = 0.8, position (x0,y0) = (0.5, 0.5) (normalized coordinates, representing the area directly above the center of the scene), and attenuation coefficient σ0 = 0.8. The search range of the parameters is set as I∈[0.5, 1.0], x∈[0.2, 0.8], y∈[0.2, 0.8], and σ∈[0.3, 1.5]. By adjusting these four parameters, various lighting conditions, ranging from bright, focused illumination to dim, diffused lighting, can be simulated.

[0017] S13: For example Figure 6As shown, the adversarial patch is first modeled parametrically. For the "push the plate to the stove" task in the LIBERO dataset, an adversarial visual patch is added to the desktop texture, and its placement in the scene is controlled by the position parameters (x, y). Specifically, the patch is defined as a 128×128 pixel square pattern, with the initial position parameters set to (x0, y0)=(0.3, 0.3) (normalized coordinates), representing the position of the patch's center point relative to the desktop. The search range is set to x∈[0.2, 0.8], y∈[0.2, 0.8], ensuring that the patch always remains within the visible area of ​​the desktop and does not exceed the scene boundaries. The patch pattern can be a natural image (e.g., a plate) or a barcode stripe image.

[0018] Step S2: Black-box optimization search based on CMA-ES The Covariance Matrix Adaptive Evolutionary Strategy (CMA-ES) is used as the core optimization engine to automatically search for the combination of physical change parameters that cause the most severe performance degradation of the visual language action model.

[0019] S21 Initialization Phase: First, define the dimensions of the parameter space: for 3D transformations, the parameter vector is [α, β, γ] with dimension d=3; for lighting transformations, the parameter vector is [I, x, y, σ] with dimension d=4; and for adversarial patches, the parameter vector is [x, y] with dimension d=2. Initialize the mean vector of the parameters to the zero vector of the corresponding dimension, indicating that the search starts from the undisturbed original scene. Set the population size to N=20, meaning 20 sets of candidate parameters are generated in each iteration, and the maximum number of iterations is set to 200.

[0020] S22 Sampling Phase: In the t-th iteration, N=20 candidate parameter sets are sampled from the current parameter distribution. , ,..., For any sampling vector Candidate parameters are obtained through transformation. , where A and B are constant terms, and their range is restricted to within the threshold.

[0021] S23 Assessment Phase: Each set of candidate parameters is applied to the simulation environment to evaluate its impact on model performance. The specific process is as follows: First, the original scene configuration file (XML format) of the task in the LIBERO dataset is read. This file defines the initial position, size, material, and other attributes of the desktop, gripping target, and robotic arm. In the target 3D transformation example, the initial pose of the stove is (0,0,0) (relative to the world coordinate system of the robotic arm base). The candidate parameters are then applied... Apply to the configuration file, to Taking [0,0,13] as an example, modify the pose node of the stove object to rotate it 13 degrees clockwise along the z-axis. In the lighting transformation embodiment, the initial parameters of the added light source are set to [0.8,0.5,0.5,0.8], and the candidate parameters are... Apply to the configuration file, to Taking [0.01, 0.05, 0.05, 0] as an example, the parameters of the light source in the scene are modified to [0.81, 0.55, 0.55, 0.8]. In the adversarial patch implementation, the initial parameters of the added patch are set to [0.5, 0.5], and the candidate parameters are... Apply to the configuration file, to For example, with the value [0.05, 0.05], the position parameter of the patch on the desktop texture image in the scene is modified to [0.55, 0.55].

[0022] Next, the updated configuration file is loaded using the MuJoCo simulator to initialize the scene and set the rendering parameters: image resolution of 256×256 pixels, viewing angle of 45 degrees directly above, and camera focal length f=50mm. One simulation step is executed to render the RGB image of the current frame. This image reflects the appearance of the scene after applying the corresponding transformation, and will be used to render the image. The natural language instructions for the task are input into the visual language action model to be tested. In this embodiment, the model tested is OpenVLA-7B with 7 billion parameters. The model output is a 7-dimensional action control vector. =[Δx, Δy, Δz, Δroll, Δpitch, Δyaw, gripper], where the first 6 dimensions represent the position and attitude increments of the robotic arm's end effector in Cartesian space, and the 7th dimension, gripper, represents the gripper's opening and closing commands (0 for opening, 1 for closing). In a undisturbed, original scene, running the VLA model yields the baseline motion vector. =[0.05, -0.03, 0.02, 0.01, 0.00, -0.02, 0] (units: meters and radians). This action instructs the six joints of the robotic arm to move according to the increments of the first six dimensions, while keeping the gripper open. Similarly, for scenarios with applied transformations, the same model inference process is used to obtain the perturbed action vector. The adversarial loss is calculated as a fitness function value. The adversarial loss is defined as the cosine similarity between the current action and the original action.

[0023] Where "·" represents the vector dot product, and ||·|| represents the L2 norm of the vector. The cosine similarity ranges from [-1, 1], with values ​​closer to 1 indicating greater similarity between the two actions, and values ​​closer to -1 indicating completely opposite directions between the two actions.

[0024] S24 Selection Phase: The 20 candidate solutions are sorted based on their fitness values. Since the optimization objective is to find the perturbation that causes the model output to deviate the most (even if the action is as inconsistent as possible with the original action), the individual with the lowest cosine similarity is selected as the optimal solution. In this iteration, the sorted fitness values ​​are: [0.873, 0.891, 0.924, 0.956, 0.982, ...], with corresponding parameter indices of [3, 20, 4, 2, 1, ...]. The top 10 individuals with the lowest fitness are selected to update the distribution parameters, calculate the new mean vector, and update the covariance matrix. The new covariance matrix reflects the most promising direction in the search space and adaptively adjusts the search step size in each dimension.

[0025] S25 Iterative convergence: Repeat steps S22-S24 for continuous iterative optimization. Set the termination condition as follows: (1) Reaching the maximum number of iterations. =200 times, or (2) the task fails. For example, in the target 3D transformation embodiment, after 92 iterations, the algorithm converges to the optimal perturbation parameter, and the corresponding minimum cosine similarity is 0.312. At this time, the action vector output by the model deviates significantly from the original action vector. This action deviation will cause the robotic arm to be unable to place the moka pot object correctly, and the task will fail.

[0026] The above description, in conjunction with specific embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for evaluating the robustness of a visual language action model in changing scenarios, characterized in that, Includes the following steps: Transform real-world spatial transformations, lighting changes, and texture perturbations into a parameterizable, continuously varying space. A covariance matrix adaptive evolution strategy is used to perform black-box optimization of the visual language action model, and the worst physical scenario that causes the model to fail is automatically searched. We construct a unified evaluation benchmark and automated execution process that includes multiple task types, and evaluate the robustness of the model through quantitative indicators.

2. The robustness evaluation method according to claim 1, characterized in that, The parametric modeling of the continuously changing space includes target 3D transformation parameters, lighting transformation parameters, and adversarial patch parameters, all of which satisfy physical rationality constraints.

3. The robustness evaluation method according to claim 2, characterized in that, The target 3D transformation parameters are rotation parameters α, β, and γ that describe the spatial attitude of the object.

4. The robustness evaluation method according to claim 2, characterized in that, The illumination transformation parameters are based on the Gaussian decay model L(z)=I exp ( ||z The equation (x,y)||² / 2σ²) is constructed, with parameters including light source intensity I, position (x,y), and attenuation coefficient σ.

5. The robustness evaluation method according to claim 2, characterized in that, The adversarial patch parameters are parameters (x, y) that control the planar position of the patch in the desktop texture.

6. The robustness evaluation method according to claim 1, characterized in that, The specific process of black-box optimization is as follows: S21 Initialization phase: Set the initial mean μ0 and covariance matrix C0 of the parameter space; S22 Sampling Phase: Sample N candidate perturbation parameter sets from the current distribution N(μ,C), where N is not less than 20; S23 Evaluation Phase: Apply each set of parameters to the simulation environment, render the current frame image, input the current frame image into the visual language action model for inference, and calculate the adversarial loss as the fitness function value, where the adversarial loss is set as the cosine similarity between the currently output action vector and the action vector output from the original scene; S24 Selection Phase: Select the individual with the best fitness from the candidate solutions and update the distribution parameter (μ). t+1 C t+1 Adaptively adjust the search direction and step size; S25 Iterative Convergence: Repeat the above process until the "worst-case scenario" perturbation configuration that results in the highest failure rate of the model is found.

7. The robustness evaluation method according to claim 6, characterized in that, The individual with the best fitness is the one with the lowest cosine similarity.

8. The robustness evaluation method according to claim 1, characterized in that, The unified evaluation benchmark includes four categories of evaluation tasks: spatial tasks, object tasks, target tasks, and long-duration tasks. Each task corresponds to original natural language instructions, scene configuration files, object attributes, and action sequence labels.

9. The robustness evaluation method according to claim 1, characterized in that, The quantitative indicators include success rate (SR) and robustness index (RI), where SR = (number of successful task completions / total number of tests) × 100%.

10. The robustness evaluation method according to claim 9, characterized in that, The robustness index RI = 1 - (success rate in the worst scenario / success rate in the original scenario).

Images