Red-team your humanoid's policy before it ships.
A humanoid runs on a whole-body vision-language-action (VLA) policy: one network turning cameras and an instruction into motion. That policy is a new attack surface, arriving as the humanoid-safety rules do. Provael's whole-body suite tests it in simulation; no real humanoid checkpoint has been measured here yet.
Who this is for
You build or integrate a humanoid, and the policy that moves it is a learned network you did not write line by line. When someone asks what it does under an instruction it was not trained on, you need a measurement to point at.
What applies to you, and when
- EU Machinery Regulation 2023/1230 - Annex III 1.1.9 and 1.2.1
- Every machine placed on the EU market must meet the Annex III requirements that apply to it, 1.1.9 and 1.2.1 among them: protection against corruption, and control systems that withstand reasonably foreseeable malicious attempts and keep self-evolving behaviour inside its task and movement space. A humanoid is a machine; its policy is the control system. A self-evolving safety component also takes the Annex I Part A third-party route.
- Delegated acts carrying the AI Act robustness requirements into Annex III
- Applicable by this date; until then Article 20(10) presumes conformity from AI Act harmonised standards, of which none had been cited in the Official Journal as of 3 August 2026, the date the regulatory clock records for that check. Between the two dates the robustness evidence in your technical file is your own.
- Product Liability Directive (EU) 2024/2853
- For products placed on the market after this date a claimant no longer proves the mechanism, and defectiveness may be presumed where you fail to disclose relevant evidence. A dated, reproducible robustness measurement can be part of that evidence.
- ISO 25785-1 (dynamically stable robots) - under development
- The machine-specific (Type-C) standard for humanoids is a Committee Draft with no publication date. Nothing can be certified against it yet, and this pack does not pretend to.
What you get
- The report and its SARIF file: the attack-success rate (how often the policy left its safe zone) with 95% confidence intervals, the benign and clean-task-success controls, and the release decision under your acceptance protocol.
- The signed attestation over the whole pack, which you verify offline.
- The technical-file annex: the test report in the ISO/IEC 17025 clause-7.8 shape (not accredited, no statement of conformity) and the crosswalk, Machinery Regulation rows first.
- The whole-body suite and the three locomotion attacks the product ships (balance_spoof, whole_body_hijack, stride_freeze), stub-validated on the CPU humanoid suite and labelled that way in the pack.
The sample evidence pack is a real pack from the committed run, published in full. The one measured result, and what it does not mean, is on the results page.
Check what the fixed price covers
The Checkpoint Report’s fixed price covers only what its eligibility table lists as supported; the table also says what is quoted separately and what is out of scope. Nothing is sent or paid before a human replies.
Feature and status claims on this page were read against the product repository on . This page was rewritten on , after that check; the re-check is pending. Unlike the numbers on /results and /leaderboard, these claims are not enforced by a build check: this is a human review with a date on it, not a guarantee. The maintained source is the repository; where it disagrees with this page, it wins.