Action-space integrity attacks (hijack / targeted trajectory / freeze)

What it is

Action-space integrity attacks target the policy’s action output directly: hijacking it into an attacker-specified trajectory, degrading task success, or freezing it into a no-op (paralysis). The visible language instruction can stay benign, so the violation is attributable to action-space integrity, not a jailbroken goal.

A hijacked-trajectory robot and a frozen robot are different severe failures - and a single “task success” metric hides both. (Freeze is also an availability / DoS failure.)

Seen in the wild

AttackVLA / BackdoorVLA (arXiv:2511.12149) drove a real robot through a targeted action sequence; FreezeVLA (arXiv:2509.19870) reported roughly 76% paralysis ASR. Both are action-output attacks - the danger is in the motion, not the words.

Attack, measure, prove

• Ships three families. `action` (freeze + trajectory_hijack) drives the motor command to a no-op or redirects the trajectory toward an attacker waypoint. `action_space` (keepout_hijack + critical_freeze) attacks the commanded end-state on a disjoint out-of-band channel - into a monitored-standstill keep-out zone, or paralysed at a safety-critical step - with the visible instruction kept benign.
• `optimized` (targeted_hijack) is a black-box, query-budgeted search that adapts a `goto::` directive to steer emitted motion toward an attacker goal - the first non-templated attack in the suite.
• Each is scored as a rate with a 95% Wilson CI against a benign-FPR control - all three stub-validated only (deterministic CPU core, 100% [72-100%] / [84-100%] vs a 0% benign baseline). A v0.20.0 transfer study verified the negative result: `action` and `action_space` are not-applicable on the real SmolVLA / π0 × LIBERO path - they inject an out-of-band directive channel a real VLA ignores, and no real suite surfaces the action-integrity signal - so they stay stub-validated by verification, not by omission. A real action-freeze / hijack number needs the GPU-gated adversarial-image path (`optimized` / FreezeVLA); no cross-model claim.

Read the EAI04 action-space transfer study →v0.20.0 · verified not-applicable on real policies

What reduces the risk

• Action sanity-bounds, rate/force limits, and motion-envelope watchdogs enforced below the policy.
• Independent keep-out-zone enforcement that fails safe on a constraint violation.
• Report ASR as a matrix (untargeted / freeze / targeted) against a clean baseline, so a hijack and a freeze are not hidden by one success metric.

How it shows up in CI

Every finding for this risk carries a stable rule id in the SARIF report - the Embodied AI Top-10 id itself:

Crosswalk

OWASP

No direct OWASP peer - action-layer integrity

MITRE ATLAS

Impact → manipulate / deny the agent’s actuation (proposed - ATLAS embodied coverage is thin)

Frameworks

NIST AI 100-2 - Integrity violationISO 10218:2025 - monitored stop / limits

See the full framework crosswalk for dates and detail. Not legal advice.