Text red-teaming stops at the sentence
Tools like garak, PyRIT, and promptfoo are excellent at one thing: scanning what a model says. They send adversarial prompts and check whether the output is toxic, jailbroken, or leaks a secret. For a chatbot, that is the whole attack surface.
A robot’s output is not a sentence
A vision-language-action policy takes a camera image and an instruction and emits an action — a motor command, a trajectory, a gripper state. The dangerous failure is not a toxic paragraph. It is the arm carrying a payload across a keep-out line, freezing at a safety-critical step, or being nudged toward an attacker’s waypoint.
That failure lives in the action space. Text-only red-teaming has nothing to score there, because the harmful output was never text.
Why this needs its own taxonomy
This is the embodiment gap, and it is why we maintain the Embodied AI Security Top 10: a robot policy has its own attack surface — adversarial perception, action-space integrity, embodied prompt injection — that the LLM and agent frameworks do not cover. OWASP’s Agentic Top 10 is scoped to software agents; MITRE ATLAS and NIST’s AI profiles have no robotics coverage today.
The practical version
If your robot has an LLM in the loop, you need both halves: red-team the language with a text tool, and red-team the resulting motion with something that models the action space and reports a calibrated attack-success rate. That second half is what Provael measures. See the full comparison →