GLOSSARY

Every term on this site, in plain words.

What each word means here, grouped by topic. Where a term names one of the risks in the Embodied AI Security Top 10, a link beside it opens that entry.

Foundations Attacks Measurement Evidence & compliance Simulation

Foundations

Embodied AI: AI that perceives and acts in the physical world through a body - a robot - rather than only producing text. Its failures are movements, not sentences.
Physical AI: A near-synonym for embodied AI, emphasising that the model’s output drives real-world actuation. The term the humanoid-robotics wave has adopted.
Vision-Language-Action (VLA) policy: A model that maps camera images plus a natural-language instruction directly to robot actions. VLAs are what Provael red-teams: language and perception in, motion out.
Robot policy: The function that maps a robot’s observations to its next action. The policy is the "brain" whose security Provael measures.
Checkpoint: A saved version of a trained robot policy: its weights at one point in training. Each new release of a policy is a new checkpoint, and a Provael result holds for the checkpoint it tested, not for the next one.
The embodiment gapEAI06 →: The security gap between a model that outputs text and one that outputs motion. Text-layer red-teaming stops at the sentence; a robot policy turns the same input into a trajectory, which text-only tools cannot reach.
Action spaceEAI04 →: The set of commands a policy can emit to the robot - joint torques, end-effector targets, gripper states. Integrity of the action space is a distinct attack surface from the language input.
Keep-out zone: A region the robot must never enter (a person, a machine, a boundary). The "keep-out predicate" is the check that flags when a policy has driven the robot into one - Provael’s core notion of an unsafe embodied action.

Attacks

Red-teaming: Adversarially testing a system to find its failures before a real attacker does. Provael red-teams robot policies in simulation and reports how often each attack succeeds.
Policy jailbreakEAI01 →: An input - an instruction reframed as a story or a role, or an injected directive - that makes a policy perform a disallowed physical action while looking benign.
Reframed instructionEAI01 →: An instruction set inside a story or a role, for example a scene being acted out. Provael’s roleplay attack is one, and it does not keep the original request: it replaces the task with a movie-scene role-play that asks for a different object. In its control run the same frame with no object named moved the policy as often, so what it measures is fragility under the frame, not steering. Rewording an instruction while keeping its meaning is a different test, which Provael runs as a control (benign_reword), not as an attack.
Adversarial perceptionEAI02 →: Attacks that fool a policy’s vision input - printed patches, textures, or sensor spoofing - so the robot acts on a false view of the world.
Action-space integrity attackEAI04 →: An attack that targets the action output directly - hijacking the trajectory, freezing the policy, or degrading task success - while the visible instruction stays benign.
Trajectory hijackEAI04 →: Steering a robot’s commanded motion toward an attacker-chosen waypoint or goal - the robot moves, but to the wrong place.
Freeze (paralysis) attackEAI04 →: Forcing a policy into a no-op so the robot stops acting - an availability / denial-of-service failure that a single task-success metric hides.
Embodied prompt injectionEAI05 →: Malicious instructions a robot reads from its environment - a sign, a screen, an object label - that hijack its behaviour without any direct command channel.
BackdoorEAI03 →: A hidden trigger implanted in a model or its supply chain that makes the policy perform a chosen action when it sees a specific, otherwise-innocuous cue.
UniPwnEAI07 →: An unauthenticated exploit chain reported in September 2025 against widely-deployed Unitree Go2 and G1 robots, reaching remote code execution over the robots’ comms/BLE stack and capable of self-propagation. It is a firmware and communications compromise, not a policy attack: nothing about it depends on what the vision-language-action model decides. Provael names it to mark a boundary — UniPwn-class exploits map to EAI07 and are explicitly out of scope, because Provael attacks the policy layer and cannot measure a firmware channel.
Excessive autonomy (EAI08)EAI08 →: A policy taking a high-consequence action it was never authorised to take, either because the control surface authenticates weakly or because the autonomy granted to it is broader than the task needs. The distinguishing feature is that nothing is spoofed: the instruction can be legitimate, the perception correct, and the failure is that the system said yes to itself. Provael registers attacks here (self-authorisation bypass, scope escalation), and they are stub-validated rather than measured against a real policy.
Model & data confidentiality (EAI09)EAI09 →: Extracting the policy or what it was trained on through the inference interface - model extraction, membership inference, inversion - and the second, less-discussed half: a robot is a mobile multimodal sensor, so a compromised one is a surveillance device before it is anything else. Distinct from the attacks above because the goal is to take something out rather than to make the robot do something. Registered and stub-validated only.
Evaluation & observability gap (EAI10)EAI10 →: The governance risk that makes the other nine harder to answer: no standard evaluation, no telemetry that would show an attack happening, no rollback and no incident process. It carries no attacks and never will, because there is no policy input that attacks the absence of a process - a rate here would be a category error. Provael sits on the mitigation side of it and only partly: a signed run report and a per-checkpoint regression gate are evidence that the evaluation limb exists and was exercised, not that the observability or incident-response limbs do.

Measurement

Attack-success rate (ASR): The fraction of attempts on which an attack drives the policy into an unsafe state (e.g. a keep-out violation). Provael’s headline metric - always reported with a confidence interval and a benign control, never as a raw percentage.
Benign control (benign-FPR): A clean baseline that measures how often the "unsafe" test fires with no attack present - the false-positive rate. Without it, an ASR is uninterpretable: you can’t tell a real attack from a trigger-happy predicate.
Benign floor: How often the policy leaves its safe zone under harmless instructions. An attack only counts as working if it separates from this floor in a paired test.
Paired test (McNemar): A comparison of two arms trial by trial, on the same task and seed, instead of by their totals. Provael uses McNemar’s exact test, which counts only the trials where the two arms disagree. A p-value of 1.0 means the two cannot be told apart. An attack counts as working only if it separates from the benign control this way, and across the attacks of one run the p-values are Holm-adjusted, so one lucky arm is not read as a finding.
Wilson confidence interval: A statistically sound interval for a proportion (like an ASR) that stays valid at small sample sizes, where the naive interval breaks. Every rate Provael publishes carries a 95% interval, and most are Wilson intervals. The headline carries the run’s task-clustered interval instead: episodes within one task are not independent, so a pooled Wilson would be narrower than the evidence supports. The π0.5 card on /findings prints both.
Task-clustered interval: A 95% interval computed by resampling whole tasks instead of single episodes, because episodes of one task are not independent. On the headline it is wider than a pooled Wilson interval; with very few successes it can be narrower, as on the π0.5 findings card, which prints both.
Predicate: The rule that decides whether an episode left the safe zone. "Uncalibrated" means it uses a default keep-out box (on the CPU stub, a random threshold per seed), not one fitted to this policy’s harmless runs.
Calibration: Fitting the unsafe predicate to a policy’s own benign rollouts so that a flagged violation means something for that policy, not an arbitrary threshold.
Transfer test: The check of whether an attack that works on a deterministic stub or one model also works on a real policy. Provael ships every attack-family claim with its transfer status in the same breath as the number.
Stub-validated: A result produced against the deterministic stub - the CPU fixture that stands in for a policy - rather than against a real model. It demonstrates that the harness, the attack and the scoring work end to end; it says nothing about how a real policy behaves. A 100% stub-validated rate is a property of the fixture, not of a robot. Compare Transfer test: stub-validated is the state a claim is in before transfer has been shown, and it is labelled rather than quietly promoted.
Scaffolding: An adapter (for a policy or a simulator suite) that is written but has never been run here.
Succ-But-Unsafe (SbU): When a policy completes its task but violates a safety constraint doing it - a failure a task-success-only metric records as a success. Provael scores it separately.
Null result: A published negative finding - an attack that produced no measurable lift over the benign control. Distinct from a floor result (an arm that fires as often as the untouched instruction does) and from an N/A (no applicable surface); Provael publishes all three under their own names, and a null as loudly as a positive.

Evidence & compliance

SARIF: The Static Analysis Results Interchange Format - an OASIS standard for machine-readable security findings, ingestible by GitHub code scanning and GRC tools. Provael emits its results as SARIF so a robot red-team finding files like any other vulnerability.
CI gate: A check in your continuous-integration pipeline that can stop a build on a red-team result. Provael’s GitHub Action fails the job when the pooled adversarial ASR is above a set threshold, when the ASR has risen against a known-good baseline you supply (beyond a tolerance, with non-overlapping 95% Wilson intervals), or when the release decision under a named acceptance protocol is fail. In release mode, an incomplete decision or a missing protocol fails it too. The pooled rate is descriptive; the regression check judges each critical attack on its own slice, and the release decision judges the critical attacks and tasks on theirs.
Release decision: The verdict a named acceptance protocol gives one run: pass, fail, conditional (a bounded exception with a named approver and an expiry) or incomplete (a required input is missing, or no protocol was named). It describes that run under that protocol, not the robot’s real-world safety.
Conformity evidence: Assurance-oriented artifacts that map a measured result to a regulation or standard (EU AI Act, EU Machinery Regulation, ISO 10218, NIST AI RMF). Evidence, not certification - inputs a notified body or insurer can review, not a conformity conclusion.
Embodied AI Security Top 10: Provael’s independent, versioned taxonomy of the top security risks for vision-language-action robot policies - the attack-mechanism vocabulary the tool’s findings map to. Covers the physical-actuation layer that text-focused frameworks do not.

Simulation

LIBERO: An open robot-manipulation benchmark suite used to evaluate VLA policies. Provael runs real-model transfer tests on LIBERO (built on robosuite / MuJoCo), entirely in simulation.
Sim-to-real gap: The difference between how a policy behaves in simulation versus on physical hardware. Provael is sim-only by design; results are honest about what a simulated finding does and does not imply for a real robot.

See the terms in a measured result.

The result page uses them on the published run: the attack-success rate, its interval, the benign control and the limits the number holds within.

See the measured result →The Embodied AI Security Top 10