{"id":"a152f111-19d3-48c6-862b-0f7fb5e2fc6d","arxiv_id":"2607.17786","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Latent-iterative reasoning makes a vision-language-action robot policy far more fragile to input perturbation, and text-based plan monitors collapse under adaptive attacks.","lead":"This paper tests whether adding a reasoning step makes robot-control AI models more resilient to image noise and attacks, and finds the opposite for one architecture. The latent-loop reasoning model collapses under perturbation while text-reasoning and no-reasoning models survive, and plan-based monitors fail under adaptive attack, a caution for VLA safety design.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Within-Prismatic recurrence is not isolated as the cause of RD-VLA's collapse; scale and recipe confounds remain, so the headline attribution is conditional.","rationale":"The reader's weakest_assumption identifies the same confound: RD-VLA and OFT differ in scale and training recipe, so the within-Prismatic recurrence is not isolated. I agree with that concern and treat it as the single most load-bearing condition for the central claim, rather than as a peripheral limitation. The empirical pattern itself, that this particular RD-VLA checkpoint is far less robust than the two comparators under Gaussian noise and PGD-10, is credible and internally consistent; the K-sweep is a clever test and its flat ρ(K) genuinely falsifies the multiplicative-depth hypothesis. What remains unsecured is the step from 'RD-VLA is fragile and depth-invariant' to 'the latent-iterative reasoning architecture is the load-bearing cause.' The paper's own §4.3 language is stronger than the evidence supports, and Section 7's model-level caveat does not fully retract it. Because the reader already made acceptance conditional, my stress-test does not move the verdict; it sharpens the condition: the architectural attribution should be downgraded to a hypothesis until a same-scale, same-recipe, no-recurrence control is run. The other flagged issues, the App. B bound and the abstain-on-flag tautology, are real but secondary; neither changes the core empirical pattern, and neither is needed to establish the main fragility result.","tokens_in":30060,"tokens_out":8693,"duration_ms":81973,"concrete_test":"Fine-tune the same 0.5B Prismatic backbone and LIBERO recipe used for RD-VLA with the recurrence removed (K=1, single-pass), keeping data, seeds, and action head otherwise fixed; re-run Table 2's Gaussian σ=0.2 and PGD-10 ε=8/255 cells. If the K=1 variant also collapses to ~15% / 0%, the encoder/scale, not the recurrence, drives the fragility; if it holds above ~80% while K=12 collapses, the recurrence is implicated. A cheaper first pass is inference-time K=1 on the existing RD-VLA checkpoints, though OOD caveats apply.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's first contribution is not merely that RD-VLA collapses, but that the within-Prismatic latent-iterative recurrence is 'the load-bearing architectural attribution' (§4.3). That causal claim is not established. RD-VLA and OFT share the Prismatic family but differ by ~14x in parameters (0.5B vs 7B), by action head (linear projection vs MLPResNet), and by fine-tuning recipe. Control (ii) in §4.3 ('SR-vulnerability ordering is non-monotone in parameters') does not control scale: a three-point sequence cannot falsify a non-monotone scale effect. Control (iii) shows only that RD-VLA's output projection is a contraction, which bounds the action head's contribution; it says nothing about whether a 0.5B Prismatic encoder is intrinsically more noise-sensitive. The CoT-disabled ablation (control iv) is within DT and underpowered (p=0.35/0.59, d=0.28 at N=12), and it tests text CoT, not latent recurrence. The K-sweep (Table 3) is an inference-time variation within RD-VLA: K-invariance falsifies per-iteration compounding but is fully consistent with an encoder/scale-driven collapse that is simply independent of K. Section 7 acknowledges N=1 per paradigm and scales paradigm statements back to 'model-level observation,' yet §4.3 and Prop. 1 state the architectural attribution as causal. If the recurrence is not the cause, the paper's central lesson ('how the reasoning stage is built' matters) reduces to a single small-model anecdote.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper tests whether adding a reasoning step makes Vision-Language-Action (VLA) models more robust to perturbation, comparing three models that span the reasoning spectrum: OpenVLA-OFT (no reasoning), DeepThinkVLA (text chain-of-thought), and RD-VLA (latent iterative recurrence). The authors inject Gaussian noise, FGSM, and PGD-10 at vision, reasoning, and action stages on LIBERO, with a SimplerEnv sanity check. They report that RD-VLA is by far the least robust (e.g., 14.8% SR under Gaussian sigma=0.2 and 0.0% under PGD-10, versus roughly 89-93% and 18-50% for the other two), and that an inference-time K-sweep (K=8 vs K=12) leaves amplification essentially unchanged, falsifying a multiplicative per-iteration compounding model. In the defense half, the paper evaluates a plan-action consistency probe and a stage-fused monitor under adaptive attack and matched-FPR calibration, finding that the consistency probe collapses to chance under stealth attacks and that no convex fusion raises defended SR above undefended SR. The manuscript includes extensive appendices with per-suite results, statistical tests, EOT checks, cross-benchmark consistency checks, and explicit limitations.","tokens_in":30356,"tokens_out":7710,"duration_ms":73967,"significance":"The empirical measurements are careful and largely convincing: matched N=12 paired cells, Holm-Bonferroni correction, bootstrap CIs, EOT and Square-Attack checks, adaptive attack evaluation, and matched-FPR calibration are all appropriate strengths. The K-sweep is a genuinely clean in-model falsification of multiplicative per-iteration compounding, and the honest reporting of underpowered ablations and selection-bias diagnostics is commendable. The defense results, properly framed as a matched-FPR cost comparison, provide a useful cautionary data point for the VLA robustness community. However, the paper's central causal claim about architecture is currently conditional on an N=1-per-paradigm design with unresolved confounds; the contribution is a well-measured model-level observation rather than a fully established architectural theorem.","major_comments":[{"comment":"The claim that the within-Prismatic recurrence is 'the load-bearing architectural attribution' is not supported by the provided controls. RD-VLA and OFT share the Prismatic backbone but differ in parameter count (0.5B vs 7B), action head (linear projection vs MLPResNet), and fine-tuning recipe. Control (ii) argues that the SR-vulnerability ordering is non-monotone in parameters, but a three-point sequence cannot falsify a non-monotone scale effect; control (iii) only shows that RD-VLA's output projection is a contraction, leaving an encoder-scale or training-recipe explanation open; and the K-sweep is an inference-time variation within RD-VLA that is fully consistent with an encoder-driven collapse independent of K. Section 7 correctly scales paradigm statements back to model-level observations, so §4.3 and Prop. 1 should either add a within-paradigm control (e.g., a latent-iterative model at larger scale, or a single-pass Prismatic model at 0.5B) or systematically replace the causal attribution with model-level language.","section":"§4.3, App. I, §7"},{"comment":"The headline that no convex fusion raises defended SR above undefended SR is true by construction under the abstain-on-flag rule: with Defended SR defined as P(success and no flag), it is always bounded above by Raw SR = P(success), independent of the attack or the probe quality. The informative empirical result is the quantitative matched-FPR cost: the text-only baseline (alpha=1) loses about 1pp, while the stage-fused monitor (alpha=0.5) loses 7.7pp. The paper should state the result as a matched-FPR cost comparison, not as an impossibility finding, otherwise readers may infer a stronger negative result than the design can support.","section":"§5.2, Eq. (3), Table 5"},{"comment":"The back-solved L_hat_iter=1.192 is a one-parameter fit anchored at K=12 using the cross-model amplification ratio 8.22, so comparing rho(12)/rho(8)=1.005 to 1.192^4≈2.0 falsifies that particular back-solved value, but it does not by itself localize the amplifier to 'the encoder plus the recurrence's fixed point'. A smaller per-iteration Lipschitz constant (e.g., L≈1.001) would also predict a flat ratio, and the cross-model ratio used in the back-solve is itself contaminated by the OFT-vs-RD-VLA confounds noted above. The flatness is a solid negative result against multiplicative compounding; the positive localization claim should be presented as a hypothesis or interpretation, not as an established conclusion.","section":"§4.2, Prop. 1, App. F"}],"minor_comments":[{"comment":"The RD-VLA FGSM cells are DT→RD-VLA transfer lower bounds, not white-box FGSM results; the table marks this with 't', but the main-text sentence 'Only under FGSM does OFT reorder above DT' should explicitly remind readers that RD-VLA's FGSM cell is not a white-box comparison.","section":"Table 2, §3.2"},{"comment":"The bound 1 - phi_bar_clean is very weak as stated: with phi_bar_clean=0.867 it permits any mean clean-vs-attacked shift up to 0.133, while the measured shifts are at most 0.022. Consider presenting it as a simple descriptive observation about the probe's limited separation, not as a structural mechanism for the probe's failure.","section":"App. B, Observation 1"},{"comment":"The K=4 row is out-of-distribution and the in-distribution falsification rests on the K∈{8,12} comparison; visually separating the K=4 row from the K=8/12 rows in the table and figure would make the evidential basis of the claim easier to follow.","section":"§4.2, Table 3"},{"comment":"The PGD-10 comparison restricts OFT to epsilon=8/255 while DT is evaluated at additional budgets; this is reasonable given compute, but the main text should note explicitly that OFT's epsilon-sweep is unavailable, since the epsilon=4/255 table in App. A shows the OFT-vs-DT ranking is already visible at that budget.","section":"§4.1, Table 2"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is within scope for the journal and the experimental work is largely solid. My main concern is calibration of the narrative: the main text and Prop. 1 state causal architectural claims that the N=1-per-paradigm design cannot support, even though Section 7 acknowledges the limitation. I would prioritize re-scoping the claims over adding new experiments, though an additional within-paradigm checkpoint would substantially strengthen the paper."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, the K-sweep falsifying multiplicative amplification and the adaptive-attack collapse of the consistency probe are genuinely new, well-measured results. Second, the paper's causal claim that the latent-iterative recurrence drives RD-VLA's fragility is not supported by the design; scale and recipe confounds remain, and the paper quietly acknowledges this in §7 while asserting it in §4.3.\n\nThe cross-stage attack matrix is a solid empirical contribution. N=12 paired cells, Holm-Bonferroni correction, bootstrap CIs, and matched-FPR calibration are above the norm for this subfield. The K-sweep is the strongest part: varying K from 8 to 12 while holding episodes fixed leaves per-step action deviation essentially flat (ratio 1.005 vs a predicted 2.0), and clean SR stays flat in that range, so the multiplicative L^K story is cleanly falsified. The probe evaluation is also genuinely careful: the adaptive ladder, the leave-one-seed-out threshold calibration, and the honest disclosure that an uncalibrated fusion gives a misleading +24.6 pp improvement are all signs of careful methodology.\n\nThe main soft spot is attribution. RD-VLA and OFT share the Prismatic backbone but differ by ~14x in parameters, action head, and training recipe. A three-point ordering cannot falsify a non-monotone scale effect, and a contraction in the output projection only rules out the action head. K-invariance is fully consistent with an encoder- or scale-driven collapse independent of K. The stress-test note we received lands exactly here. The paper itself says in §7 that every paradigm-level statement is a model-level observation, yet §4.3 and Prop. 1 call the recurrence 'the load-bearing architectural attribution.' That internal tension needs resolving—either add a matched-scale control or re-scope the claim. There are two smaller issues: Observation 1's bound in App. B is not derived and looks invalid for a [0,1]-valued score (the empirical AUCs are the real evidence), and the fusion-ceiling headline is tautological under abstain-on-flag, as App. E admits; the informative number is the absolute defended SR (48.8% vs 49.8% raw), not the 'never lifts above' framing. Code and data are not public yet.\n\nThis is for VLA robustness and safety researchers, and for anyone who wants a model of adaptive evaluation. I would bring it to a reading group. It deserves a serious referee; the empirical core should survive if the attribution is scaled back and the artifacts are released. My recommendation: accept for peer review with expectation of heavy revision, and push the authors to be as careful in the abstract as they are in the limitations.","headline":"Two strong empirical results hiding behind an overclaimed causal story; the K-invariance and probe-collapse deserve a referee's time, but the architecture attribution has real confounds.","tokens_in":30946,"tokens_out":4058,"would_cite":true,"duration_ms":36072,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Latent iterative reasoning makes VLA policies least robust under perturbation, and text-based safety monitors fail under adaptive attack.","keywords":["vision-language-action models","robustness","adversarial perturbations","chain-of-thought reasoning","latent iterative reasoning","cross-stage attacks","adaptive defenses","manipulation benchmarks"],"falsifier":"Train a second latent-iterative VLA at roughly 7B scale with the same fine-tuning protocol as OpenVLA-OFT and evaluate it under Gaussian $\\sigma=0.2$ and white-box PGD-10 at $\\varepsilon=8/255$ on LIBERO; if its success rate does not collapse, or if its amplification ratio becomes $K$-dependent, the structural-amplifier attribution is falsified.","tokens_in":29771,"feed_emoji":"🤖","tokens_out":20451,"duration_ms":143872,"temperature":0.7,"pith_summary":"This paper tests the intuition that a robot policy that reasons before acting should absorb corrupted inputs better than one that maps pixels directly to actions, by comparing three vision-language-action models spanning the reasoning spectrum: no reasoning, text chain-of-thought, and a latent iterative loop. The result is that the latent-iterative model is the least robust: under Gaussian sensor noise its task success collapses to 14.8%, and under white-box PGD-10 attack to 0.0%, while the text chain-of-thought model holds 92.7% and the no-reasoning baseline 89.0% under Gaussian noise. A recurrence-depth sweep shows the fragility is structural rather than cumulative: varying the loop from 8 to 12 iterations leaves amplification unchanged ($\\rho(12)/\\rho(8)=1.005$ versus 2.0 if it compounded per step). The paper also establishes that text-based safety monitors cannot rescue the system: a plan–action consistency probe with naive AUC 0.996 falls to chance under an adaptive attacker, and no convex fusion with an action-anomaly probe raises defended success above undefended success. The practical stake is that architecture choice, not the presence of reasoning, governs robustness, and that the obvious reason-based safety checks are not reliable against an informed attacker.","feed_headline":"Latent reasoning collapses robot-policy success to 0% under attack","feed_subtitle":"Text chain-of-thought keeps 92.7% success under sensor noise; the latent loop drops to 14.8% and to 0% under attack.","key_machinery":"The load-bearing object is the three-stage pipeline $a_t = f^a(f^r(f^v(o_t),\\ell))$ with perturbations injected separately at the vision, reasoning, and action stages. The three models instantiate the reasoning stage as the identity (OpenVLA-OFT), a text chain-of-thought (DeepThinkVLA), or a weight-tied latent recurrence $f^r = g^{\\circ K}$ with $K=12$ (RD-VLA). The argument runs on two instruments: the end-to-end amplification ratio $\\rho(K)=\\|\\Delta a\\|_2/\\varepsilon$, which is shown to be $K$-invariant for in-distribution $K\\in\\{8,12\\}$ and thereby falsifies the multiplicative form $L_{\\mathrm{iter}}^K$; and the coherent-perturbation bound, which says that when a vision-stage perturbation enters both the plan and the action through the same perturbed latent, any clean-versus-attacked separation of a consistency probe is bounded above by $1-\\bar{\\phi}_{\\mathrm{clean}}$. The adaptive-attack ladder and the matched-FPR fusion sweep are the testing harnesses that expose the monitor ceilings.","core_discovery":"The paper's central discovery is a three-tier robustness ordering that is not monotone in reasoning: under Gaussian vision noise at $\\sigma=0.2$, the text-CoT model DeepThinkVLA retains 92.7% task success, the no-reasoning OpenVLA-OFT 89.0%, and the latent-iterative RD-VLA collapses to 14.8%; under white-box PGD-10 at $\\varepsilon=8/255$ the ordering is 49.8% (DeepThinkVLA) > 18.2% (OpenVLA-OFT) > 0.0% (RD-VLA). The fragility is traced to a structural amplifier: the end-to-end amplification ratio $\\rho(K)=\\|\\Delta a\\|_2/\\varepsilon$ is flat across inference-time recurrence depths $K\\in\\{8,12\\}$ ($\\rho(12)/\\rho(8)=1.005$ against 2.0 predicted by per-iteration Lipschitz growth), localizing the amplifier in the encoder and the recurrence's fixed-point output rather than in compounding depth. On the defense side, the paper establishes a ceiling for output-level behavioral monitors: a plan–action consistency probe that detects naive entity-swap corruption with AUC 0.996 collapses to 0.493 under stealthy adaptive re-injection, and under matched-FPR calibration no convex fusion of that probe with a Mahalanobis action-anomaly score raises defended task success above undefended success on any PGD-10 cell. The paper also finds that text chain-of-thought's measurable safety contribution is inspectability—a readable plan to check—not noise filtering, since a CoT-disabled ablation shows no statistically detectable robustness difference.","pith_inferences":["Editorial inference: the $K$-invariant amplification is what one would expect if the recurrence drives perturbed latents toward a fixed-point attractor; if so, the defense-relevant object is the latent-space geometry near that attractor, and larger $\\varepsilon$ should saturate rather than scale, matching the paper's saturation data.","Editorial inference: because the three models also differ in scale and training recipe, the cleanest test of the architectural claim is a same-scale latent-iterative replica; a non-collapsing replica would move the fragility from 'latent reasoning' to 'small-scale latent reasoning'.","Editorial inference: the coherent-shift bound implies that any monitor reading only stage outputs faces the same ceiling, so the natural next step—which the paper explicitly leaves open—is probing the latent representation before the action head rather than the outputs."],"forward_implications":["Latent-iterative VLA policies should not be treated as safer because they reason before acting; across the three tested architectures they are the least robust to both stochastic and white-box perturbation.","Shrinking or extending the latent loop at inference is not a robustness lever: the $K$-invariance result places the amplifier in the encoder and fixed-point output, not in the number of iterations.","Any defense built on reading stage outputs—text consistency or action anomaly—must first surpass the matched-FPR ceiling the paper documents; otherwise defended success cannot exceed undefended success.","Text chain-of-thought contributes inspectability rather than measurable noise filtering, so a policy's safety case should rely on what the plan makes visible, not on an assumed denoising benefit."],"supporting_citations":[{"why":"Supplies the PGD-10 white-box attack used for the headline three-tier robustness ordering.","marker":"[9]"},{"why":"Establishes the adaptive-evaluation standard under which the consistency probes are tested.","marker":"[12]"},{"why":"Prior entity-swap CoT attack that the paper extends from the reasoning stage to a full cross-stage matrix.","marker":"[44]"},{"why":"Provides DeepThinkVLA, the text chain-of-thought model in the reasoning spectrum.","marker":"[5]"},{"why":"Provides RD-VLA, the latent iterative model whose K=12 recurrence is the central fragile object.","marker":"[6]"},{"why":"Provides the OpenVLA model family and the no-reasoning baseline for the comparison.","marker":"[2]"},{"why":"Provides the OFT fine-tuning recipe that defines the OpenVLA-OFT no-reasoning baseline.","marker":"[8]"},{"why":"Supplies the LIBERO benchmark with its four manipulation suites used for the N=12 evaluation grid.","marker":"[10]"},{"why":"Supplies the seven naturalistic perturbation factors that corroborate the latent-amplifier reading outside synthetic attacks.","marker":"[7]"},{"why":"Supplies SimplerEnv as a cross-benchmark sanity check for the FGSM versus PGD-10 asymmetry.","marker":"[11]"}],"fun_headline_variants":["Latent reasoning makes robot policies more fragile, not less","Reasoning step backfires: latent loop tanks robot task success","Text reasoning helps, latent loop hurts robot robustness","Latent iterative reasoning collapses under attack in robot policies","Reasoning is a double-edged sword: latent loop fails under attack"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the shared Prismatic backbone controls for architecture well enough that the collapse is caused by the latent recurrence itself, even though RD-VLA is 0.5B against OpenVLA-OFT's 7B, uses a different training recipe, and is one model per reasoning family—so scale or training data could in principle drive the gap.","fun_headline_variants_meta":{"raw":{"variants":["Latent reasoning makes robot policies more fragile, not less","Reasoning step backfires: latent loop tanks robot task success","Text reasoning helps, latent loop hurts robot robustness","Latent iterative reasoning collapses under attack in robot policies","Reasoning is a double-edged sword: latent loop fails under attack"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000624,"raw_usage":{"total_tokens":2996,"prompt_tokens":1162,"completion_tokens":1834,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":778,"completion_tokens_details":{"reasoning_tokens":1753}},"tokens_in":778,"tokens_out":1834,"duration_ms":12084,"temperature":1.0,"reasoning_tokens":1753,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T15:34:55.318206+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a second latent-iterative VLA at roughly 7B scale with the same fine-tuning protocol as OpenVLA-OFT and evaluate it under Gaussian $\\sigma=0.2$ and white-box PGD-10 at $\\varepsilon=8/255$ on LIBERO; if its success rate does not collapse, or if its amplification ratio becomes $K$-dependent, the structural-amplifier attribution is falsified.","supporting_citations":[{"cited_title":"Madry, A","cited_arxiv_id":null,"evidence_quote":"Supplies the PGD-10 white-box attack used for the headline three-tier robustness ordering."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Prior entity-swap CoT attack that the paper extends from the reasoning stage to a full cross-stage matrix."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the OpenVLA model family and the no-reasoning baseline for the comparison."}],"review_version":1}