# The embodiment gap: what text red-teaming misses - Provael

> Markdown twin of https://www.provael.com/notes/the-embodiment-gap/ - derived mechanically from the page's own rendered content at
> build time (it can state nothing the page does not). Curated, data-driven twins exist for the
> key pages; this one is generated so the twin convention has no holes.

RESEARCH NOTE · Jul 21, 2026

# The embodiment gap: what text red-teaming misses

Tools like garak and PyRIT scan what a model says. A robot policy turns language into motion, and that is a failure text-only red-teaming has nothing to score.

## Text red-teaming stops at the sentence

Tools like garak, PyRIT, and promptfoo are excellent at one thing: scanning what a model says. They send adversarial prompts and check whether the output is toxic, jailbroken, or leaks a secret. For a chatbot, that is the whole attack surface.

## A robot’s output is not a sentence

A vision-language-action policy takes a camera image and an instruction and emits an action - a motor command, a trajectory, a gripper state. The dangerous failure is not a toxic paragraph. It is the arm carrying a payload across a keep-out line, freezing at a safety-critical step, or being nudged toward an attacker’s waypoint.

That failure lives in the action space. Text-only red-teaming has nothing to score there, because the harmful output was never text.

## Why this needs its own taxonomy

This is the embodiment gap, and it is why we maintain the [Embodied AI Security Top 10](https://www.provael.com/eai-top-10/): a robot policy has its own attack surface - adversarial perception, action-space integrity, embodied prompt injection - that the LLM and agent frameworks do not cover. OWASP’s Agentic Top 10 is scoped to software agents; MITRE ATLAS and NIST’s AI profiles have no robotics coverage today.

## The practical version

If your robot has an LLM in the loop, you need both halves: red-team the language with a text tool, and red-team the resulting motion with something that models the action space and reports an attack-success rate. That second half is what Provael measures. [See the full comparison →](https://www.provael.com/compare/)

Written by Sattyam Jain, founder of Provael. [About the author →](https://www.provael.com/about/)

One email a month

One email a month: the results that landed, the errata, and what is next. Nothing else, no spam, unsubscribe in one click.

Subscribe

---
Canonical: https://www.provael.com/notes/the-embodiment-gap/