Action-space integrity attacks (hijack / targeted trajectory / freeze)

In plain words

The risk

The attack goes after the robot’s motion commands directly, sending the arm to an attacker’s waypoint, spoiling the task or freezing it while the instruction looks normal.

What Provael tests

The action, action_space and optimized families try to redirect or freeze the commanded motion in simulation.Stub-validated: the attack code works on a CPU test fixture; no real-policy result is claimed.

What it does not cover

A transfer study found that action and action_space do not apply to a real VLA policy, which ignores the channel they use. A real number needs an adversarial-image attack, not yet run.

In the glossary: Action space, Action-space integrity attack, Trajectory hijack, Freeze (paralysis) attack

What it is

Action-space integrity attacks target the policy’s action output directly: hijacking it into an attacker-specified trajectory, degrading task success, or freezing it into a no-op (paralysis). The visible language instruction can stay benign, so the violation is attributable to action-space integrity, not a jailbroken goal.

A hijacked-trajectory robot and a frozen robot are different severe failures - and a single “task success” metric hides both. (Freeze is also an availability / DoS failure.)

Seen in the wild

AttackVLA / BackdoorVLA (arXiv:2511.12149) drove a real robot through a targeted action sequence; FreezeVLA (arXiv:2509.19870) reported roughly 76% paralysis ASR. Both are action-output attacks - the danger is in the motion, not the words.

How Provael tests it

• Ships three families. action (freeze + trajectory_hijack) drives the motor command to a no-op or redirects the trajectory toward an attacker waypoint. action_space (keepout_hijack + critical_freeze) attacks the commanded end-state on a disjoint out-of-band channel - into a monitored-standstill keep-out zone, or paralysed at a safety-critical step - with the visible instruction kept benign.
• optimized (targeted_hijack) is a black-box, query-budgeted search that adapts a goto:: directive to steer emitted motion toward an attacker goal - the first non-templated attack in the suite.
• Each is scored as a rate with a 95% Wilson CI against a benign-FPR control - all three stub-validated only (deterministic CPU core, 100% [72-100%] / [84-100%] vs a 0% benign baseline). A v0.20.0 transfer study verified the negative result: action and action_space are not-applicable on the real SmolVLA / π0 × LIBERO path - they inject an out-of-band directive channel a real VLA ignores, and no real suite surfaces the action-integrity signal - so they stay stub-validated by verification, not by omission. A real action-freeze / hijack number needs the GPU-gated adversarial-image path (optimized / FreezeVLA); no cross-model claim.

Read the EAI04 action-space transfer study → v0.20.0 · verified not-applicable on real policies

What reduces the risk

• Action sanity-bounds, rate/force limits, and motion-envelope watchdogs enforced below the policy.
• Independent keep-out-zone enforcement that fails safe on a constraint violation.
• Report ASR as a matrix (untargeted / freeze / targeted) against a clean baseline, so a hijack and a freeze are not hidden by one success metric.

How it shows up in CI

Every finding for this risk carries a stable rule id in the SARIF report: the Embodied AI Top 10 id itself.

Crosswalk

OWASP

No direct OWASP peer - action-layer integrity

MITRE ATLAS

Impact → manipulate / deny the agent’s actuation (proposed - ATLAS embodied coverage is thin)

Frameworks

NIST AI 100-2 - Integrity violationISO 10218:2025 - monitored stop / limits

See the full framework crosswalk for dates and detail. Not legal advice.