What it is
A policy jailbreak is a natural-language command - issued directly, or through an LLM planner - that drives a vision-language-action policy to act against its safety constraints. It is the embodied analog of an LLM jailbreak, except the output is a physical action plan, not a sentence.
Because a VLA policy turns language straight into motion, a successful jailbreak does not just produce a bad answer - it produces a bad trajectory. It is the cheapest and most transferable attack in this list, because it rides the normal command channel to a moving robot.
Seen in the wild
RoboPAIR demonstrated the first algorithmic jailbreak of LLM-controlled robots - roughly 100% attack-success rate across three systems, including a deployed Unitree Go2, with prompts that mapped to physically harmful actions; BadRobot (ICLR 2025) reproduced the class. Provael’s own run is deliberately narrow and measured: the `roleplay` attack diverted a real SmolVLA×LIBERO policy on 44 of 50 trials (88%), task-clustered 95% CI [72-100%], against a 4% benign baseline - sim-only, all ten libero_object tasks, 5 seeds each, with an uncalibrated “diverted out of the benign envelope” predicate (not a hazard rate). A paired benign-reword arm fired on 1 of 50, so the effect is attacker control rather than brittleness to rephrasing.
Attack, measure, prove
- Runs the `instruction` family (roleplay, goal-substitution, paraphrase reframings) over seeded trials paired with an equal benign control set, and reports the benign false-positive rate alongside every result.
- Resolves the outcome into an attack-success rate with a 95% Wilson confidence interval and emits a SARIF finding under ruleId EAI01.
- This is the one family with a real measured transfer result (SmolVLA×LIBERO, above) - still sim-only, one task, n=10; reproduce with `provael calibrate` + `attack --calib`.
Measured defense: instruction canonicalization → Measured against this risk: the instruction and optimized_instruction families, on a CPU fixture. No real-model transfer is claimed.
What reduces the risk
- Instruction provenance and integrity/authentication checks before the policy acts on a goal.
- A runtime plan-validation guardrail (temporal-logic / executability checks, e.g. RoboGuard) that runs independent of the policy.
- Embodied-harm refusal training, plus a CI red-team gate that fails the build when the measured ASR crosses your threshold.
How it shows up in CI
Every finding for this risk carries a stable rule id in the SARIF report - the Embodied AI Top-10 id itself:
Crosswalk
- OWASP
- ASI01 Agent Goal Hijack · LLM01 Prompt Injection
- MITRE ATLAS
- ML Attack Staging → jailbreak of an ML-driven agent
- Frameworks
- NIST AI RMF - Measure (red-team & gate on ASR)
See the full framework crosswalk for dates and detail. Not legal advice.