What it is
A policy jailbreak is a natural-language command — issued directly, or through an LLM planner — that drives a vision-language-action policy to act against its safety constraints. It is the embodied analog of an LLM jailbreak, except the output is a physical action plan, not a sentence.
Because a VLA policy turns language straight into motion, a successful jailbreak does not just produce a bad answer — it produces a bad trajectory. It is the cheapest and most transferable attack in this list, because it rides the normal command channel to a moving robot.
Seen in the wild
RoboPAIR demonstrated the first algorithmic jailbreak of LLM-controlled robots — roughly 100% attack-success rate across three systems, including a deployed Unitree Go2, with prompts that mapped to physically harmful actions; BadRobot (ICLR 2025) reproduced the class. Provael’s own run is deliberately narrow and measured: the `roleplay` attack diverted a real SmolVLA×LIBERO policy 100% (10/10), 95% Wilson CI [72–100%], against a 0% benign baseline — sim-only, one task (libero_object/0), n=10, with an uncalibrated “diverted out of the benign envelope” predicate (not a hazard rate).
Attack, measure, prove
- Runs the `instruction` family (roleplay, goal-substitution, paraphrase reframings) over seeded trials paired with an equal benign control set, and reports the benign false-positive rate alongside every result.
- Resolves the outcome into an attack-success rate with a 95% Wilson confidence interval and emits a SARIF finding under ruleId EAI01.
- This is the one family with a real measured transfer result (SmolVLA×LIBERO, above) — still sim-only, one task, n=10; reproduce with `provael calibrate` + `attack --calib`.
What reduces the risk
- Instruction provenance and integrity/authentication checks before the policy acts on a goal.
- A runtime plan-validation guardrail (temporal-logic / executability checks, e.g. RoboGuard) that runs independent of the policy.
- Embodied-harm refusal training, plus a CI red-team gate that fails the build when the measured ASR crosses your threshold.
How it shows up in CI
Every finding for this risk carries a stable rule id in the SARIF report — the Embodied AI Top-10 id itself:
Crosswalk
- OWASP
- ASI01 Agent Goal Hijack · LLM01 Prompt Injection
- MITRE ATLAS
- ML Attack Staging → jailbreak of an ML-driven agent
- Frameworks
- NIST AI RMF — Measure (red-team & gate on ASR)
See the full framework crosswalk for dates and detail. Not legal advice.