Adversarial perception (patches / textures / sensor spoofing)

What it is

Adversarial perception manipulates what the policy sees or senses - an adversarial patch, a printed texture or sticker, a 3D texture, or a spoofed depth/LiDAR signal - so its behaviour flips while the perturbation looks benign to a human and the text instruction stays legitimate.

For an embodied policy the consequence is physical: a misperceived object pose or boundary becomes an unsafe motion. It lives in the physical environment, not the network - it needs no system access and survives air-gaps.

Seen in the wild

Adversarial-patch and action-aware attacks against VLA models are documented (“Adversarial vulnerabilities of VLA models”, arXiv:2411.13587). The honest result from Provael’s own run is a null: these did NOT transfer to the real SmolVLA×LIBERO policy - the `visual` family scored 0% (0/100 - patch and decoy_object, 50 each), 95% CI [0-3.7%], against the same 4% benign baseline. Real-world robustness of perception attacks is unsettled, which is exactly why you test it rather than assume it.

Attack, measure, prove

• Ships two families: `visual` (patch + decoy_object, a scalar-danger perturbation) and `sensor_spoof` (patch_spoof + signal_spoof).
• The method is a sim-injected perception spoof - an adversarial patch on the simulated camera, or a range/depth perturbation on the simulated LiDAR - that makes the policy perceive a phantom target inside a monitored-standstill keep-out zone and command its end-effector there. It perturbs the simulator’s observation stream, never real sensor hardware.
• Scored as a keep-out-violation rate with a 95% Wilson CI against a benign-FPR control. Stub-validated only (deterministic CPU `reach` suite: 100% [84-100%] vs a 0% benign baseline); real-model transfer is GPU-gated and, on the one real run, did not transfer (see example). No cross-model claim.

What reduces the risk

• Input smoothing/randomization and adversarial training for known patch classes.
• Multi-view and multi-sensor agreement, plus perception-embedding anomaly detection.
• Physical red-team with printed artifacts; independent runtime keep-out enforcement regardless of perception.

How it shows up in CI

Every finding for this risk carries a stable rule id in the SARIF report - the Embodied AI Top-10 id itself:

Crosswalk

OWASP

No direct OWASP peer - perception-layer risk

MITRE ATLAS

Defense Evasion → craft adversarial data (perception channel)

Frameworks

NIST AI 100-2 - Evasion (integrity)

See the full framework crosswalk for dates and detail. Not legal advice.