# EAI04: Action-space integrity attacks (hijack / targeted trajectory / freeze)

> Attacks optimized in the action output itself — hijack the trajectory to an attacker waypoint, degrade task success, or freeze the policy into paralysis.

SARIF rule id: `EAI04` · Provael family: action/action_space/optimized (stub-validated — run it to measure your own policy)

## Definition

Action-space integrity attacks target the policy’s action output directly: hijacking it into an attacker-specified trajectory, degrading task success, or freezing it into a no-op (paralysis). The visible language instruction can stay benign, so the violation is attributable to action-space integrity, not a jailbroken goal.

A hijacked-trajectory robot and a frozen robot are different severe failures — and a single “task success” metric hides both. (Freeze is also an availability / DoS failure.)

## Real example

AttackVLA / BackdoorVLA (arXiv:2511.12149) drove a real robot through a targeted action sequence; FreezeVLA (arXiv:2509.19870) reported roughly 76% paralysis ASR. Both are action-output attacks — the danger is in the motion, not the words.

## How Provael tests it

- Ships three families. `action` (freeze + trajectory_hijack) drives the motor command to a no-op or redirects the trajectory toward an attacker waypoint. `action_space` (keepout_hijack + critical_freeze) attacks the commanded end-state on a disjoint out-of-band channel — into a monitored-standstill keep-out zone, or paralysed at a safety-critical step — with the visible instruction kept benign.
- `optimized` (targeted_hijack) is a black-box, query-budgeted search that adapts a `goto::` directive to steer emitted motion toward an attacker goal — the first non-templated attack in the suite.
- Each is scored as a rate with a 95% Wilson CI against a benign-FPR control. All three are stub-validated only (deterministic CPU core, 100% [72–100%] / [84–100%] vs a 0% benign baseline); real SmolVLA×LIBERO transfer (AttackVLA / FreezeVLA) is GPU-gated and not run — no cross-model claim.

## Mitigations

- Action sanity-bounds, rate/force limits, and motion-envelope watchdogs enforced below the policy.
- Independent keep-out-zone enforcement that fails safe on a constraint violation.
- Report ASR as a matrix (untargeted / freeze / targeted) against a clean baseline, so a hijack and a freeze are not hidden by one success metric.

## Crosswalk

- OWASP: No direct OWASP peer — action-layer integrity
- MITRE ATLAS: Impact → manipulate / deny the agent’s actuation (proposed — ATLAS embodied coverage is thin)
- Frameworks: NIST AI 100-2 — Integrity violation, ISO 10218:2025 — monitored stop / limits

Canonical: https://www.provael.com/eai-top-10/eai04 · v0.2

---
Provael · Prove it. Prevail. · Apache-2.0 · https://github.com/provael/provael
Not legal advice; verify regulatory dates against the primary source.