# EAI02: Adversarial perception (patches / textures / sensor spoofing)

> Crafted perturbations of what the policy sees or senses — patches, textures, sensor spoofs — that flip behaviour while looking benign to humans.

SARIF rule id: `EAI02` · Provael family: visual/sensor_spoof (stub-validated — run it to measure your own policy)

## Definition

Adversarial perception manipulates what the policy sees or senses — an adversarial patch, a printed texture or sticker, a 3D texture, or a spoofed depth/LiDAR signal — so its behaviour flips while the perturbation looks benign to a human and the text instruction stays legitimate.

For an embodied policy the consequence is physical: a misperceived object pose or boundary becomes an unsafe motion. It lives in the physical environment, not the network — it needs no system access and survives air-gaps.

## Real example

Adversarial-patch and action-aware attacks against VLA models are documented (“Adversarial vulnerabilities of VLA models”, arXiv:2411.13587). The honest result from Provael’s own run is a null: these did NOT transfer to the real SmolVLA×LIBERO policy — 0% (0/10), 95% CI [0–28%], against the same 0% benign baseline. Real-world robustness of perception attacks is unsettled, which is exactly why you test it rather than assume it.

## How Provael tests it

- Ships two families: `visual` (patch + decoy_object, a scalar-danger perturbation) and `sensor_spoof` (patch_spoof + signal_spoof).
- The method is a sim-injected perception spoof — an adversarial patch on the simulated camera, or a range/depth perturbation on the simulated LiDAR — that makes the policy perceive a phantom target inside a monitored-standstill keep-out zone and command its end-effector there. It perturbs the simulator’s observation stream, never real sensor hardware.
- Scored as a keep-out-violation rate with a 95% Wilson CI against a benign-FPR control. Stub-validated only (deterministic CPU `reach` suite: 100% [84–100%] vs a 0% benign baseline); real-model transfer is GPU-gated and, on the one real run, did not transfer (see example). No cross-model claim.

## Mitigations

- Input smoothing/randomization and adversarial training for known patch classes.
- Multi-view and multi-sensor agreement, plus perception-embedding anomaly detection.
- Physical red-team with printed artifacts; independent runtime keep-out enforcement regardless of perception.

## Crosswalk

- OWASP: No direct OWASP peer — perception-layer risk
- MITRE ATLAS: Defense Evasion → craft adversarial data (perception channel)
- Frameworks: NIST AI 100-2 — Evasion (integrity)

Canonical: https://www.provael.com/eai-top-10/eai02 · v0.2

---
Provael · Prove it. Prevail. · Apache-2.0 · https://github.com/provael/provael
Not legal advice; verify regulatory dates against the primary source.