# EAI01: Policy & instruction jailbreak (direct command channel)

> Natural-language commands that drive a VLA policy against its safety constraints — an LLM jailbreak, output as a physical action plan.

SARIF rule id: `EAI01` · measured on a real SmolVLA policy: roleplay 100% (10/10) [72–100% CI], sim, n=10

## Definition

A policy jailbreak is a natural-language command — issued directly, or through an LLM planner — that drives a vision-language-action policy to act against its safety constraints. It is the embodied analog of an LLM jailbreak, except the output is a physical action plan, not a sentence.

Because a VLA policy turns language straight into motion, a successful jailbreak does not just produce a bad answer — it produces a bad trajectory. It is the cheapest and most transferable attack in this list, because it rides the normal command channel to a moving robot.

## Real example

RoboPAIR demonstrated the first algorithmic jailbreak of LLM-controlled robots — roughly 100% attack-success rate across three systems, including a deployed Unitree Go2, with prompts that mapped to physically harmful actions; BadRobot (ICLR 2025) reproduced the class. Provael’s own run is deliberately narrow and measured: the `roleplay` attack diverted a real SmolVLA×LIBERO policy 100% (10/10), 95% Wilson CI [72–100%], against a 0% benign baseline — sim-only, one task (libero_object/0), n=10, with an uncalibrated “diverted out of the benign envelope” predicate (not a hazard rate).

External validation (distinct from Provael's own number): RoboPAIR (Robey et al., UPenn) — arXiv:2410.13691 — https://arxiv.org/abs/2410.13691

## How Provael tests it

- Runs the `instruction` family (roleplay, goal-substitution, paraphrase reframings) over seeded trials paired with an equal benign control set, and reports the benign false-positive rate alongside every result.
- Resolves the outcome into an attack-success rate with a 95% Wilson confidence interval and emits a SARIF finding under ruleId EAI01.
- This is the one family with a real measured transfer result (SmolVLA×LIBERO, above) — still sim-only, one task, n=10; reproduce with `provael calibrate` + `attack --calib`.

## Mitigations

- Instruction provenance and integrity/authentication checks before the policy acts on a goal.
- A runtime plan-validation guardrail (temporal-logic / executability checks, e.g. RoboGuard) that runs independent of the policy.
- Embodied-harm refusal training, plus a CI red-team gate that fails the build when the measured ASR crosses your threshold.

## Crosswalk

- OWASP: ASI01 Agent Goal Hijack · LLM01 Prompt Injection
- MITRE ATLAS: ML Attack Staging → jailbreak of an ML-driven agent
- Frameworks: NIST AI RMF — Measure (red-team & gate on ASR)

Canonical: https://www.provael.com/eai-top-10/eai01 · v0.2

---
Provael · Prove it. Prevail. · Apache-2.0 · https://github.com/provael/provael
Not legal advice; verify regulatory dates against the primary source.