Flow-matching Vision-Language-Action (VLA) policies generate actions through -indexed ordinary differential equation (ODE) rollouts, exposing intermediate velocity-field structure that endpoint-only adversarial objectives do not directly target. We study this mechanism on the evaluated ₀. ₅ policy in LIBERO and propose the Tau-Path Coupled Attack (TPCA), a white-box visual attack that couples executed-window endpoint displacement with velocity-field divergence along the flow rollout. The study is deliberately scoped as a single-architecture mechanism analysis rather than a general claim about all flow-matching policies. Under matched compute against Visual-PGD, TPCA and endpoint-only optimization both produce near-saturated task failure at 3/255, while TPCA yields larger action-space endpoint displacement. As the perturbation budget tightens, the task-level gap becomes visible: at 1/255, TPCA induces a Drop of 0. 38 whereas endpoint-only optimization induces 0. 17, with over +129\% larger action-space endpoint displacement. Cross-task checks on two additional LIBERO spatial tasks show consistent action-space endpoint-displacement advantages for the evaluated setting, while task-failure advantages are budget- and task-dependent. These results support a bounded conclusion: flow-rollout coupling provides additional optimization signal for the evaluated ₀. ₅ policy, but broader architectural generalization and defense effectiveness require future extensive studies.
Liu et al. (Wed,) studied this question.