THE VOCABULARY OF EMBODIED AI SECURITY · PV-014
Embodied AI security, defined.
A new category needs a shared vocabulary. These are the terms Provael measures against - from vision-language-action policies to attack-success rate - each defined plainly, and linked to the Embodied AI Security Top 10 where it maps to a specific risk.
Foundations
- Embodied AI
- AI that perceives and acts in the physical world through a body - a robot - rather than only producing text. Its failures are movements, not sentences.
- Physical AI
- A near-synonym for embodied AI, emphasising that the model’s output drives real-world actuation. The term the humanoid-robotics wave has adopted.
- Vision-Language-Action (VLA) policy
- A model that maps camera images plus a natural-language instruction directly to robot actions. VLAs are what Provael red-teams: language and perception in, motion out.
- Robot policy
- The function that maps a robot’s observations to its next action. The policy is the "brain" whose security Provael measures.
- The embodiment gapEAI06 →
- The security gap between a model that outputs text and one that outputs motion. Text-layer red-teaming stops at the sentence; a robot policy turns the same input into a trajectory, which text-only tools cannot reach.
- Action spaceEAI04 →
- The set of commands a policy can emit to the robot - joint torques, end-effector targets, gripper states. Integrity of the action space is a distinct attack surface from the language input.
- Keep-out zone
- A region the robot must never enter (a person, a machine, a boundary). The "keep-out predicate" is the check that flags when a policy has driven the robot into one - Provael’s core notion of an unsafe embodied action.
Attacks
- Red-teaming
- Adversarially testing a system to find its failures before a real attacker does. Provael red-teams robot policies in simulation and reports how often each attack succeeds.
- Policy jailbreakEAI01 →
- An input - reworded instruction, roleplay frame, injected directive - that makes a policy perform a disallowed physical action while looking benign.
- Adversarial perceptionEAI02 →
- Attacks that fool a policy’s vision input - printed patches, textures, or sensor spoofing - so the robot acts on a false view of the world.
- Action-space integrity attackEAI04 →
- An attack that targets the action output directly - hijacking the trajectory, freezing the policy, or degrading task success - while the visible instruction stays benign.
- Trajectory hijackEAI04 →
- Steering a robot’s commanded motion toward an attacker-chosen waypoint or goal - the robot moves, but to the wrong place.
- Freeze (paralysis) attackEAI04 →
- Forcing a policy into a no-op so the robot stops acting - an availability / denial-of-service failure that a single task-success metric hides.
- Embodied prompt injectionEAI05 →
- Malicious instructions a robot reads from its environment - a sign, a screen, an object label - that hijack its behaviour without any direct command channel.
- BackdoorEAI03 →
- A hidden trigger implanted in a model or its supply chain that makes the policy perform a chosen action when it sees a specific, otherwise-innocuous cue.
- UniPwnEAI07 →
- An unauthenticated exploit chain reported in September 2025 against widely-deployed Unitree Go2 and G1 robots, reaching remote code execution over the robots’ comms/BLE stack and capable of self-propagation. It is a firmware and communications compromise, not a policy attack: nothing about it depends on what the vision-language-action model decides. Provael names it to mark a boundary — UniPwn-class exploits map to EAI07 and are explicitly out of scope, because Provael attacks the policy layer and cannot measure a firmware channel.
- Excessive autonomy (EAI08)EAI08 →
- A policy taking a high-consequence action it was never authorised to take, either because the control surface authenticates weakly or because the autonomy granted to it is broader than the task needs. The distinguishing feature is that nothing is spoofed: the instruction can be legitimate, the perception correct, and the failure is that the system said yes to itself. Provael registers attacks here (self-authorisation bypass, scope escalation), and they are stub-validated rather than measured against a real policy.
- Model & data confidentiality (EAI09)EAI09 →
- Extracting the policy or what it was trained on through the inference interface - model extraction, membership inference, inversion - and the second, less-discussed half: a robot is a mobile multimodal sensor, so a compromised one is a surveillance device before it is anything else. Distinct from the attacks above because the goal is to take something out rather than to make the robot do something. Registered and stub-validated only.
- Evaluation & observability gap (EAI10)EAI10 →
- The governance risk that makes the other nine harder to answer: no standard evaluation, no telemetry that would show an attack happening, no rollback and no incident process. It carries no attacks and never will, because there is no policy input that attacks the absence of a process - a rate here would be a category error. Provael sits on the mitigation side of it and only partly: a signed run report and a per-checkpoint regression gate are evidence that the evaluation limb exists and was exercised, not that the observability or incident-response limbs do.
Measurement
- Attack-success rate (ASR)
- The fraction of attempts on which an attack drives the policy into an unsafe state (e.g. a keep-out violation). Provael’s headline metric - always reported with a confidence interval and a benign control, never as a raw percentage.
- Benign control (benign-FPR)
- A clean baseline that measures how often the "unsafe" test fires with no attack present - the false-positive rate. Without it, an ASR is uninterpretable: you can’t tell a real attack from a trigger-happy predicate.
- Wilson confidence interval
- A statistically-sound interval for a proportion (like an ASR) that stays valid at small sample sizes, where the naive interval breaks. Provael reports a 95% Wilson CI on every rate.
- Calibration
- Fitting the unsafe predicate to a policy’s own benign rollouts so that a flagged violation means something for that policy, not an arbitrary threshold. Calibration is what turns a demo into a measurement.
- Transfer test
- The check of whether an attack that works on a deterministic stub or one model also works on a real policy. Provael ships every attack-family claim with its transfer status in the same breath as the number.
- Stub-validated
- A result produced against the deterministic stub - the CPU fixture that stands in for a policy - rather than against a real model. It demonstrates that the harness, the attack and the scoring work end to end; it says nothing about how a real policy behaves. A 100% stub-validated rate is a property of the fixture, not of a robot. Compare Transfer test: stub-validated is the state a claim is in before transfer has been shown, and it is labelled rather than quietly promoted.
- Succ-But-Unsafe (SbU)
- When a policy completes its task but violates a safety constraint doing it - a failure a task-success-only metric records as a success. Provael scores it separately.
- Null result
- A published negative finding - an attack that did not transfer, or produced no measurable lift. Provael publishes nulls as loudly as positives; a security measurement is only worth its honesty.
Evidence & compliance
- SARIF
- The Static Analysis Results Interchange Format - an OASIS standard for machine-readable security findings, ingestible by GitHub code scanning and GRC tools. Provael emits its results as SARIF so a robot red-team finding files like any other vulnerability.
- CI gate
- A continuous-integration check that fails a build when the measured ASR exceeds a set threshold - turning "is this policy safe enough?" into an automated, reproducible pass/fail.
- Conformity evidence
- Assurance-oriented artifacts that map a measured result to a regulation or standard (EU AI Act, EU Machinery Regulation, ISO 10218, NIST AI RMF). Evidence, not certification - inputs a notified body or insurer can review, not a conformity conclusion.
- Embodied AI Security Top 10
- Provael’s independent, versioned taxonomy of the top security risks for vision-language-action robot policies - the attack-mechanism vocabulary the tool’s findings map to. Covers the physical-actuation layer that text-focused frameworks do not.
Simulation
- LIBERO
- An open robot-manipulation benchmark suite used to evaluate VLA policies. Provael runs real-model transfer tests on LIBERO (built on robosuite / MuJoCo), entirely in simulation.
- Sim-to-real gap
- The difference between how a policy behaves in simulation versus on physical hardware. Provael is sim-only by design; results are honest about what a simulated finding does and does not imply for a real robot.
From vocabulary to a verified number.
Every term here is something Provael can measure on your policy - with a confidence interval and a benign control.