Adversarial perception (patches / textures / sensor spoofing)

In plain words

The risk

Someone changes what the robot sees or senses, with a printed patch, a texture or a spoofed depth signal, so it acts on a false picture of the world.

What Provael tests

visual plants a patch or a decoy object in what the policy sees, and sensor_spoof fakes camera or LiDAR signals, all inside the simulator.On a real policy in simulation, visual fired no more often than harmless instructions did: the benign floor. No rate is claimed. sensor_spoof is stub-validated only, with no real-policy result.

What it does not cover

The visual attacks are symbolic markers, not optimised adversarial pixels, so a result from them is not evidence that a policy resists perception attacks.

In the glossary: Adversarial perception

What it is

Adversarial perception manipulates what the policy sees or senses - an adversarial patch, a printed texture or sticker, a 3D texture, or a spoofed depth/LiDAR signal - so its behaviour flips while the perturbation looks benign to a human and the text instruction stays legitimate.

For an embodied policy the consequence is physical: a misperceived object pose or boundary becomes an unsafe motion. It lives in the physical environment, not the network - it needs no system access and survives air-gaps.

Seen in the wild

Adversarial-patch and action-aware attacks against VLA models are documented (“Adversarial vulnerabilities of VLA models”, arXiv:2411.13587).

What Provael measured

Provael’s own result on the real SmolVLA×LIBERO policy sits at the benign floor: the visual family fired on 2/100 (patch and decoy_object, 50 each), as often as the untouched instruction did (benign 1/50) on the same tasks, McNemar p = 1.0 against it - published as “not separated from the benign floor”, never as a rate and never as zero (it was a zero on the 9 August 2026 run; /errata records the change).

Real-world robustness of perception attacks is unsettled, which is exactly why you test it rather than assume it.

How Provael tests it

• Ships two families: visual (patch + decoy_object, a scalar-danger perturbation) and sensor_spoof (patch_spoof + signal_spoof).
• The method is a sim-injected perception spoof - an adversarial patch on the simulated camera, or a range/depth perturbation on the simulated LiDAR - that makes the policy perceive a phantom target inside a monitored-standstill keep-out zone and command its end-effector there. It perturbs the simulator’s observation stream, never real sensor hardware.
• Scored as a keep-out-violation rate with a 95% Wilson CI against a benign-FPR control. The stub fixture (deterministic CPU reach suite: 100% [84-100%] vs a 0% benign baseline) exercises the code path only; on the one real run the family stayed at the benign floor (see example). No cross-model claim.

What reduces the risk

• Input smoothing/randomization and adversarial training for known patch classes.
• Multi-view and multi-sensor agreement, plus perception-embedding anomaly detection.
• Physical red-team with printed artifacts; independent runtime keep-out enforcement regardless of perception.

How it shows up in CI

Every finding for this risk carries a stable rule id in the SARIF report: the Embodied AI Top 10 id itself.

Crosswalk

OWASP

No direct OWASP peer - perception-layer risk

MITRE ATLAS

Defense Evasion → adversarial example in the perception channel (craft adversarial data)

Frameworks

NIST AI 100-2 - Evasion (integrity)

See the full framework crosswalk for dates and detail. Not legal advice.