Pith. sign in

REVIEW 3 major objections 4 minor 71 references

Reasoning as a Double-Edged Sword: Architecture and Cross-Stage Robustness in Vision-Language-Action Models

T0 review · 3 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Latent iterative reasoning makes VLA policies least robust under perturbation, and text-based safety monitors fail under adaptive attack.

desk verdict Two strong empirical results hiding behind an overclaimed causal story; the K-invariance and probe-collapse deserve a referee's time, but the architecture attribution has real confounds. read the letter →

arxiv 2607.17786 v1 pith:NBRZOARX submitted 2026-07-20 cs.RO cs.AIcs.CRcs.LG

Tuan Duong Trinh , Naveed Akhtar , Basim Azam This is my paper · ORCID
classification cs.ROcs.AIcs.CRcs.LG
keywords vision-language-actionmodelsrobustnessadversarialperturbationschain-of-thoughtreasoninglatentiterativecross-stageattacksadaptivedefensesmanipulationbenchmarks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tests the intuition that a robot policy that reasons before acting should absorb corrupted inputs better than one that maps pixels directly to actions, by comparing three vision-language-action models spanning the reasoning spectrum: no reasoning, text chain-of-thought, and a latent iterative loop. The result is that the latent-iterative model is the least robust: under Gaussian sensor noise its task success collapses to 14.8%, and under white-box PGD-10 attack to 0.0%, while the text chain-of-thought model holds 92.7% and the no-reasoning baseline 89.0% under Gaussian noise. A recurrence-depth sweep shows the fragility is structural rather than cumulative: varying the loop from 8 to 12 iterations leaves amplification unchanged ($\rho(12)/\rho(8)=1.005$ versus 2.0 if it compounded per step). The paper also establishes that text-based safety monitors cannot rescue the system: a plan–action consistency probe with naive AUC 0.996 falls to chance under an adaptive attacker, and no convex fusion with an action-anomaly probe raises defended success above undefended success. The practical stake is that architecture choice, not the presence of reasoning, governs robustness, and that the obvious reason-based safety checks are not reliable against an informed attacker.

What carries the argument

The load-bearing object is the three-stage pipeline $a_t = f^a(f^r(f^v(o_t),\ell))$ with perturbations injected separately at the vision, reasoning, and action stages. The three models instantiate the reasoning stage as the identity (OpenVLA-OFT), a text chain-of-thought (DeepThinkVLA), or a weight-tied latent recurrence $f^r = g^{\circ K}$ with $K=12$ (RD-VLA). The argument runs on two instruments: the end-to-end amplification ratio $\rho(K)=\|\Delta a\|_2/\varepsilon$, which is shown to be $K$-invariant for in-distribution $K\in\{8,12\}$ and thereby falsifies the multiplicative form $L_{\mathrm{iter}}^K$; and the coherent-perturbation bound, which says that when a vision-stage perturbation enters both the plan and the action through the same perturbed latent, any clean-versus-attacked separation of a consistency probe is bounded above by $1-\bar{\phi}_{\mathrm{clean}}$. The adaptive-attack ladder and the matched-FPR fusion sweep are the testing harnesses that expose the monitor ceilings.

What would settle it

Train a second latent-iterative VLA at roughly 7B scale with the same fine-tuning protocol as OpenVLA-OFT and evaluate it under Gaussian $\sigma=0.2$ and white-box PGD-10 at $\varepsilon=8/255$ on LIBERO; if its success rate does not collapse, or if its amplification ratio becomes $K$-dependent, the structural-amplifier attribution is falsified.

Watch

Extended reading notes

Core claim

The paper's central discovery is a three-tier robustness ordering that is not monotone in reasoning: under Gaussian vision noise at $\sigma=0.2$, the text-CoT model DeepThinkVLA retains 92.7% task success, the no-reasoning OpenVLA-OFT 89.0%, and the latent-iterative RD-VLA collapses to 14.8%; under white-box PGD-10 at $\varepsilon=8/255$ the ordering is 49.8% (DeepThinkVLA) > 18.2% (OpenVLA-OFT) > 0.0% (RD-VLA). The fragility is traced to a structural amplifier: the end-to-end amplification ratio $\rho(K)=\|\Delta a\|_2/\varepsilon$ is flat across inference-time recurrence depths $K\in\{8,12\}$ ($\rho(12)/\rho(8)=1.005$ against 2.0 predicted by per-iteration Lipschitz growth), localizing the amplifier in the encoder and the recurrence's fixed-point output rather than in compounding depth. On the defense side, the paper establishes a ceiling for output-level behavioral monitors: a plan–action consistency probe that detects naive entity-swap corruption with AUC 0.996 collapses to 0.493 under stealthy adaptive re-injection, and under matched-FPR calibration no convex fusion of that probe with a Mahalanobis action-anomaly score raises defended task success above undefended success on any PGD-10 cell. The paper also finds that text chain-of-thought's measurable safety contribution is inspectability—a readable plan to check—not noise filtering, since a CoT-disabled ablation shows no statistically detectable robustness difference.

Load-bearing premise

The load-bearing premise is that the shared Prismatic backbone controls for architecture well enough that the collapse is caused by the latent recurrence itself, even though RD-VLA is 0.5B against OpenVLA-OFT's 7B, uses a different training recipe, and is one model per reasoning family—so scale or training data could in principle drive the gap.

Editorial extensions

If this is right

  • Latent-iterative VLA policies should not be treated as safer because they reason before acting; across the three tested architectures they are the least robust to both stochastic and white-box perturbation.
  • Shrinking or extending the latent loop at inference is not a robustness lever: the $K$-invariance result places the amplifier in the encoder and fixed-point output, not in the number of iterations.
  • Any defense built on reading stage outputs—text consistency or action anomaly—must first surpass the matched-FPR ceiling the paper documents; otherwise defended success cannot exceed undefended success.
  • Text chain-of-thought contributes inspectability rather than measurable noise filtering, so a policy's safety case should rely on what the plan makes visible, not on an assumed denoising benefit.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the $K$-invariant amplification is what one would expect if the recurrence drives perturbed latents toward a fixed-point attractor; if so, the defense-relevant object is the latent-space geometry near that attractor, and larger $\varepsilon$ should saturate rather than scale, matching the paper's saturation data.
  • Editorial inference: because the three models also differ in scale and training recipe, the cleanest test of the architectural claim is a same-scale latent-iterative replica; a non-collapsing replica would move the fragility from 'latent reasoning' to 'small-scale latent reasoning'.
  • Editorial inference: the coherent-shift bound implies that any monitor reading only stage outputs faces the same ceiling, so the natural next step—which the paper explicitly leaves open—is probing the latent representation before the action head rather than the outputs.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. This paper tests whether adding a reasoning step makes Vision-Language-Action (VLA) models more robust to perturbation, comparing three models that span the reasoning spectrum: OpenVLA-OFT (no reasoning), DeepThinkVLA (text chain-of-thought), and RD-VLA (latent iterative recurrence). The authors inject Gaussian noise, FGSM, and PGD-10 at vision, reasoning, and action stages on LIBERO, with a SimplerEnv sanity check. They report that RD-VLA is by far the least robust (e.g., 14.8% SR under Gaussian sigma=0.2 and 0.0% under PGD-10, versus roughly 89-93% and 18-50% for the other two), and that an inference-time K-sweep (K=8 vs K=12) leaves amplification essentially unchanged, falsifying a multiplicative per-iteration compounding model. In the defense half, the paper evaluates a plan-action consistency probe and a stage-fused monitor under adaptive attack and matched-FPR calibration, finding that the consistency probe collapses to chance under stealth attacks and that no convex fusion raises defended SR above undefended SR. The manuscript includes extensive appendices with per-suite results, statistical tests, EOT checks, cross-benchmark consistency checks, and explicit limitations.

Significance. The empirical measurements are careful and largely convincing: matched N=12 paired cells, Holm-Bonferroni correction, bootstrap CIs, EOT and Square-Attack checks, adaptive attack evaluation, and matched-FPR calibration are all appropriate strengths. The K-sweep is a genuinely clean in-model falsification of multiplicative per-iteration compounding, and the honest reporting of underpowered ablations and selection-bias diagnostics is commendable. The defense results, properly framed as a matched-FPR cost comparison, provide a useful cautionary data point for the VLA robustness community. However, the paper's central causal claim about architecture is currently conditional on an N=1-per-paradigm design with unresolved confounds; the contribution is a well-measured model-level observation rather than a fully established architectural theorem.

major comments (3)
  1. [§4.3, App. I, §7] The claim that the within-Prismatic recurrence is 'the load-bearing architectural attribution' is not supported by the provided controls. RD-VLA and OFT share the Prismatic backbone but differ in parameter count (0.5B vs 7B), action head (linear projection vs MLPResNet), and fine-tuning recipe. Control (ii) argues that the SR-vulnerability ordering is non-monotone in parameters, but a three-point sequence cannot falsify a non-monotone scale effect; control (iii) only shows that RD-VLA's output projection is a contraction, leaving an encoder-scale or training-recipe explanation open; and the K-sweep is an inference-time variation within RD-VLA that is fully consistent with an encoder-driven collapse independent of K. Section 7 correctly scales paradigm statements back to model-level observations, so §4.3 and Prop. 1 should either add a within-paradigm control (e.g., a latent-iterative model at larger scale, or a single-pass Prismatic model at 0.5B) or systematically replace the causal attribution with model-level language.
  2. [§5.2, Eq. (3), Table 5] The headline that no convex fusion raises defended SR above undefended SR is true by construction under the abstain-on-flag rule: with Defended SR defined as P(success and no flag), it is always bounded above by Raw SR = P(success), independent of the attack or the probe quality. The informative empirical result is the quantitative matched-FPR cost: the text-only baseline (alpha=1) loses about 1pp, while the stage-fused monitor (alpha=0.5) loses 7.7pp. The paper should state the result as a matched-FPR cost comparison, not as an impossibility finding, otherwise readers may infer a stronger negative result than the design can support.
  3. [§4.2, Prop. 1, App. F] The back-solved L_hat_iter=1.192 is a one-parameter fit anchored at K=12 using the cross-model amplification ratio 8.22, so comparing rho(12)/rho(8)=1.005 to 1.192^4≈2.0 falsifies that particular back-solved value, but it does not by itself localize the amplifier to 'the encoder plus the recurrence's fixed point'. A smaller per-iteration Lipschitz constant (e.g., L≈1.001) would also predict a flat ratio, and the cross-model ratio used in the back-solve is itself contaminated by the OFT-vs-RD-VLA confounds noted above. The flatness is a solid negative result against multiplicative compounding; the positive localization claim should be presented as a hypothesis or interpretation, not as an established conclusion.
minor comments (4)
  1. [Table 2, §3.2] The RD-VLA FGSM cells are DT→RD-VLA transfer lower bounds, not white-box FGSM results; the table marks this with 't', but the main-text sentence 'Only under FGSM does OFT reorder above DT' should explicitly remind readers that RD-VLA's FGSM cell is not a white-box comparison.
  2. [App. B, Observation 1] The bound 1 - phi_bar_clean is very weak as stated: with phi_bar_clean=0.867 it permits any mean clean-vs-attacked shift up to 0.133, while the measured shifts are at most 0.022. Consider presenting it as a simple descriptive observation about the probe's limited separation, not as a structural mechanism for the probe's failure.
  3. [§4.2, Table 3] The K=4 row is out-of-distribution and the in-distribution falsification rests on the K∈{8,12} comparison; visually separating the K=4 row from the K=8/12 rows in the table and figure would make the evidential basis of the claim easier to follow.
  4. [§4.1, Table 2] The PGD-10 comparison restricts OFT to epsilon=8/255 while DT is evaluated at additional budgets; this is reasonable given compute, but the main text should note explicitly that OFT's epsilon-sweep is unavailable, since the epsilon=4/255 table in App. A shows the OFT-vs-DT ranking is already visible at that budget.

Circularity Check

1 steps flagged · score 2.0 of 10

One acknowledged definitional ceiling (abstain-on-flag guarantees defended SR ≤ undefended) is framed as a measured result; the core robustness measurements and K-sweep are independent, so circularity is minor.

  1. self definitional [Section 5.2, Table 5 ('Stage-fused monitor ceiling under matched FPR') and Contributions list, Introduction.]
    "Evaluation runs post hoc on the existing trajectory corpus under an abstain-on-flag rule, so defended SR is bounded above by undefended SR by construction. Even without an attack the bound is active... The matched-FPR sweep maps the ceiling along the fusion-weight axis. Defended task success stays below undefended at every α (Table 5)."

    The paper's contribution that 'no linear fusion of the text-consistency and action-anomaly probes raises defended SR above undefended SR on any PGD-10 cell' follows immediately from the evaluation rule: with abstain-on-flag, defended SR equals raw SR minus flagged successful episodes, so defended SR ≤ raw SR for every α regardless of probe quality. The paper explicitly calls the bound 'by construction', yet the same statement is offered as a measured ceiling ('Defended task success stays below undefended at every α'). The quantitative deficits, trigger rates, and the checker-aware adaptive-attack degradation are genuine measurements; the 'never raises above undefended' framing is a definitional consequence of the protocol rather than a data-driven discovery.

full rationale

The central empirical content of the paper is self-contained and non-circular. Cross-stage robustness is measured against external benchmarks (LIBERO, SimplerEnv, LIBERO-Plus) with new white-box attacks through RD-VLA's K=12 recurrence, and the headline collapse (DT 92.7% / OFT 89.0% / RD-VLA 14.8% under Gaussian σ=0.2; PGD-10 49.8% / 18.2% / 0.0%) is a fresh measurement not derived from any fitted parameter. The K-sweep is a genuine test: L_hat_iter=1.192 is explicitly back-solved from a single-K ratio as a hypothesis, and the inference-time sweep at K∈{8,12} then falsifies the multiplicative form (ρ(12)/ρ(8)=1.005 vs predicted 2.0); this is a prediction about new operating points, not a restatement of the fit. The consistency probe inherits its form and weights from the authors' prior work [44], but the paper states the weights are not load-bearing, and the adaptive-attack evaluation (AUC 0.996→0.493 under stealth; checker-aware PGD-10 reducing defended SR) is an independent adversarial test of that probe, so this self-citation does not carry the conclusion. The only step that reduces by construction is the §5.2 claim that no fusion raises defended SR above undefended, which is guaranteed by the abstain-on-flag rule and acknowledged as such; it is a secondary framing issue, not the load-bearing derivation. Confounding of architecture with scale/recipe is a correctness limitation explicitly disclosed in §7, not a circularity. Overall score reflects one acknowledged definitional ceiling; the paper's main measurements and falsifications are independent.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central empirical claims are self-contained measurements, but three inherited assumptions matter: (a) the consistency probe form and weights come from the authors' own prior work [44] and are not re-derived here; (b) the three-model panel is one model per reasoning family, so paradigm-level attribution is a model-level observation; (c) Observation 1's stated bound on probe separation is asserted in App. B without a valid derivation, so the coherent-shift explanation is heuristic, though the empirical AUC numbers are direct evidence. The free parameters listed (probe weights, back-solved L_hat_iter) are not load-bearing: the probe weights are stated as non-critical, and L_hat_iter is used only to formulate a hypothesis that the K-sweep then falsifies.

free parameters (2)
  • Consistency probe weights (w_e, w_d, w_g, w_p) = (0.5, 0.2, 0.15, 0.15)
    Equation 2; carried from the authors' prior work [44]. The paper states the weights are not load-bearing because the entity term carries the signal, so their impact on conclusions is limited.
  • Back-solved per-iteration Lipschitz L_hat_iter = 1.192
    App. F; a one-parameter fit at K=12 from the observed ratio 8.22 = L_hat_iter^12. Used only to construct the multiplicative hypothesis that the K-sweep then falsifies, so it is not load-bearing.
assumptions (4)
  • domain assumption Three models are representative of their reasoning paradigm (one per family)
    Sections 3.1 and 7: conclusions about text-CoT vs latent-iterative vs no-reasoning are drawn from single models per family; the paper flags this limitation.
  • domain assumption PGD-10 strictly dominates FGSM on the same model, so white-box FGSM on RD-VLA was not run; transfer lower bounds are used
    Section 3.2 and App. A: 'PGD-10 strictly dominates FGSM as the stronger attack on the same model.' This justifies using DT-to-RD-VLA transfer for RD-VLA FGSM cells.
  • ad hoc to paper Observation 1's separation bound: mean clean-versus-attacked probe separation is bounded by 1 - phi_bar_clean
    App. B: the stated bound is not derived and is not generally valid for a [0,1]-valued score; the empirical AUCs are the operative evidence, so this axiom does not break the central claim.
  • domain assumption Inference-time K-sweep without retraining measures cumulative versus structural amplification
    Section 4.2 and App. F: varying the num_iter flag at inference on a model trained at K=12 is used to falsify the L^K form; K=4 is OOD and K in {8,12} is a narrow range.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Reasoning as a Double-Edged Sword: Architecture and Cross-Stage Robustness in Vision-Language-Action Models." pith.science (2026). https://pith.science/paper/NBRZOARX

@misc{pith2026260717786,
  author       = {Pith},
  title        = {Pith review of: Reasoning as a Double-Edged Sword: Architecture and Cross-Stage Robustness in Vision-Language-Action Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NBRZOARX}},
  note         = {Machine review of arXiv:2607.17786}
}
read the original abstract

Does adding a reasoning step make a Vision-Language-Action (VLA) model more robust to perturbation? Intuitively, a policy that reasons before acting should absorb a perturbed input better than one that maps observations directly to actions. We test this premise head-on across three models that span the reasoning spectrum (no reasoning, a text chain-of-thought, and a latent iterative loop), perturbing each at the vision, reasoning, and action stages on LIBERO and SimplerEnv. Two questions organize the study: does the reasoning design shift robustness, and can the reasoning be read back at runtime as a safety signal? We find that the latent-iterative model is by far the least robust: under both stochastic noise and white-box perturbation its task success collapses, while the other two hold. This fragility is structural rather than cumulative: varying the reasoning depth at inference barely moves it. Reasoning outputs can in principle be monitored, but the monitors fail under fair tests. A plan--action consistency probe that looks near-perfect under naive evaluation falls to chance under adaptive attack. Under matched-FPR calibration, fusing it with an action-anomaly probe never lifts defended success above undefended. Scoped to these output-level behavioral probes under white-box vision-stage attack, this ceiling is a precondition that any viable defense must first satisfy.

Figures

Figures reproduced from arXiv: 2607.17786 by the authors.

Figure 1
Figure 1. The three VLAs span the reasoning spectrum (rows). [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Cross-stage vulnerability profile. (a) Gaussian vision noise dose-response: DT and OFT withstand, RD-VLA collapses. (b) Action-stage Gaussian noise produces a sharp cliff between σ=0.1 and σ=0.5 on all three models. (c) Two-tier Gaussian vulnerability at σ=0.2 (∆SR by suite): RD-VLA collapses (−74.3pp) while DT (−0.3pp) and OFT (−7.5pp) are inconclusive at N=12 (p=0.30). Error bars ±1 SE. The FGSM dose-response is i… view at source ↗
Figure 3
Figure 3. The σ=0.2 collapse, in rollouts. Representative episodes under Gaussian sensor noise (σ=0.2) on a libero_object task (“pick up the tomato sauce and place it in the basket”), sampled at even fractions (0%–100%) of each rollout from an identical start state. The latent-iterative RD-VLA (top) leaves the object untouched and fails, while the text-CoT DeepThinkVLA (bottom) completes the pick-and-place and succeeds, the p… view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Stage-fused guard (α=0.5) under checker-aware adaptive PGD-10 (ε=8/255). As the action-anomaly penalty weight λ increases, both detection AUC (left) and defended SR (right) drop on libero_object and libero_spatial. Numerical values: App. D. An adaptive attacker drives …
Figure 5
Figure 5. Figure 5: RD-VLA K-sweep at ε=8/255 (N=12 per K). Observed amplification ρ(K) is statistically flat (slope gives Lˆ iter=1.0007, free-intercept fit), inconsistent with the back-solved Liter=1.192 prediction (dotted line, anchored at K=12). The data positively identify a K-invari…
Figure 6
Figure 6. Figure 6: Amplification cascade (7,752 paired clean–perturbed episode records). OFT attenuates (ρOFT≈0.56), DT amplifies moderately (ρDT≈1.84), RD-VLA amplifies strongly (ρRD-VLA≈4.61, 2.5× DT). The recurrent reasoning stage is the structural multiplier (8.22× over the no-reason…
Figure 7
Figure 7. Figure 7: Perturbation amplification analysis. Left: per-stage spectral norms—RD-VLA’s output projection is a contraction (σ1=0.091); amplification occurs upstream in recurrent layers. Center: end-to-end amplification at σ=0.2. Right: the K-sweep test at K∈{4, 8, 12} ( [PITH_FU…
Figure 8
Figure 8. Figure 8: CoT-disabled ablation on DeepThinkVLA (N=12 suite/seed pairs). Bars show mean SR (±SE) under clean and Gaussian σ=0.2 conditions. CoT-enabled drops 0.3 pp under noise; CoT-disabled drops 1.5 pp (gap +1.2 pp; Shapiro-selected Wilcoxon p=0.59, paired t p=0.35, both non-s…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

71 extracted references · 38 canonical work pages

  1. [1]

    Brohan, N

    A. Brohan, N. Brown, J. Carbajal, Y . Chebotar, J. Dabis, C. Finn, K. Gopalakrishnan, K. Hausman, A. Herzog, J. Hsu, J. Ibarz, B. Ichter, A. Irpan, N. J. Joshi, S. Levine, Y . Lu, V . Murali, I. Mordatch, S. Nair, K. Pertsch, K. Quiambao, K. Rao, M. Ryoo, G. Salazar, P. Sankeeti, P. Sermanet, J. Singh, A. Singh, R. Soricut, H. Tran, V . Vanhoucke, F. Xia,...

    arXiv 2023

  2. [2]

    M. J. Kim, K. Pertsch, S. Karamcheti, T. Xiao, A. Balakrishna, S. Nair, R. Rafailov, E. P. Foster, G. Lam, P. R. Sanketi, Q. Vuong, T. Kollar, B. Burchfiel, R. Tedrake, D. Sadigh, S. Levine, P. Liang, and C. Finn. OpenVLA: An open-source vision-language-action model. InProceedings of the Conference on Robot Learning (CoRL),

    work page

  3. [3]

    Black, N

    K. Black, N. Brown, D. Driess, A. Esmail, M. Equi, C. Finn, N. Fusai, L. Groom, K. Hausman, B. Ichter, S. Jakubczak, T. Jones, L. Ke, S. Levine, A. Li-Bell, M. Mothukuri, S. Nair, K. Pertsch, L. X. Shi, J. Tanner, Q. Vuong, A. Walling, H. Wang, and U. Zhilinsky.π0: A vision-language-action flow model for general robot control.arXiv preprint arXiv:2410.241...

    arXiv

  4. [4]

    Zawalski, W

    M. Zawalski, W. Chen, K. Pertsch, O. Mees, C. Finn, and S. Levine. Robotic control via embodied chain-of-thought reasoning. InConference on Robot Learning (CoRL), 2024. arXiv:2407.08693

    arXiv 2024

  5. [5]

    C. Yin, Y . Lin, W. Xu, S. Tam, X. Zeng, Z. Liu, and Z. Yin. DeepThinkVLA: Enhancing reasoning capability of vision-language-action models.arXiv preprint arXiv:2511.15669, 2025

    arXiv 2025

  6. [6]

    Y . Tur, J. Naghiyev, H. Fang, W.-C. Tsai, J. Duan, D. Fox, and R. Krishna. Recurrent-depth VLA: Implicit test-time compute scaling of vision-language-action models via latent iterative reasoning.arXiv preprint arXiv:2602.07845, 2026

    arXiv 2026

  7. [7]

    Fei, Wang, Shi, Dai, Cai, Qian, Ji, He, Zhang, Fei, Fu, Gong, and Qiu

    S. Fei, Wang, Shi, Dai, Cai, Qian, Ji, He, Zhang, Fei, Fu, Gong, and Qiu. LIBERO-Plus: In-depth robustness analysis of vision-language-action models.arXiv preprint arXiv:2510.13626, 2025

    arXiv 2025

  8. [8]

    M. J. Kim, C. Finn, and P. Liang. Fine-tuning vision-language-action models: Optimizing speed and success. arXiv preprint arXiv:2502.19645, 2025. Robotics: Science and Systems (RSS) 2025

    arXiv 2025

Show all 71 references
  1. [9]

    Madry, A

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. InInternational Conference on Learning Representations (ICLR), 2018

    2018

  2. [10]

    B. Liu, Y . Zhu, C. Gao, Y . Feng, Q. Liu, Y . Zhu, and P. Stone. LIBERO: Benchmarking knowledge transfer for lifelong robot learning. InAdvances in Neural Information Processing Systems (NeurIPS), volume 36, 2023. arXiv:2306.03310

    2023 arXiv

  3. [11]

    X. Li, K. Hsu, J. Gu, K. Pertsch, O. Mees, H. R. Walke, C. Fu, I. Lunawat, I. Sieh, S. Kirmani, S. Levine, J. Wu, C. Finn, H. Su, Q. Vuong, and T. Xiao. Evaluating real-world robot manipulation policies in simulation.arXiv preprint arXiv:2405.05941, 2024

    2024 arXiv

  4. [12]

    Carlini, A

    N. Carlini, A. Athalye, N. Papernot, W. Brendel, J. Rauber, D. Tsipras, I. Goodfellow, A. Madry, and A. Kurakin. On evaluating adversarial robustness.arXiv preprint arXiv:1902.06705, 2019

    1902 arXiv

  5. [13]

    Brohan, N

    A. Brohan, N. Brown, J. Carbajal, Y . Chebotar, et al. RT-1: Robotics transformer for real-world control at scale. InRobotics: Science and Systems (RSS), 2023. 9 Reasoning as a Double-Edged Sword in VLAsA PREPRINT

    2023

  6. [14]

    Black et al

    K. Black et al. π0.5: A vision-language-action model with open-world generalization.arXiv preprint arXiv:2504.16054, 2025

    2025 arXiv

  7. [15]

    Pertsch, K

    K. Pertsch, K. Stachowicz, B. Ichter, D. Driess, et al. FAST: Efficient action tokenization for vision-language- action models.arXiv preprint arXiv:2501.09747, 2025

    2025 arXiv

  8. [16]

    Karamcheti, S

    S. Karamcheti, S. Nair, A. Balakrishna, P. Liang, T. Kollar, and D. Sadigh. Prismatic VLMs: Investigating the design space of visually-conditioned language models. InInternational Conference on Machine Learning (ICML), 2024

    2024

  9. [17]

    S. Liu, L. Wu, B. Li, H. Tan, H. Chen, Z. Wang, K. Xu, H. Su, and J. Zhu. RDT-1B: a diffusion foundation model for bimanual manipulation.arXiv preprint arXiv:2410.07864, 2024

    2024 arXiv

  10. [18]

    Ghosh, H

    Octo Model Team, D. Ghosh, H. Walke, K. Pertsch, et al. Octo: An open-source generalist robot policy.arXiv preprint arXiv:2405.12213, 2024

    2024 arXiv

  11. [19]

    T. Z. Zhao, V . Kumar, S. Levine, and C. Finn. Learning fine-grained bimanual manipulation with low-cost hardware. InRobotics: Science and Systems (RSS), 2023

    2023

  12. [20]

    C. Chi, Z. Xu, S. Feng, E. Cousineau, Y . Du, B. Burchfiel, R. Tedrake, and S. Song. Diffusion policy: Visuomotor policy learning via action diffusion.The International Journal of Robotics Research, 2025

    2025

  13. [21]

    Walke, K

    H. Walke, K. Black, A. Lee, M. J. Kim, M. Du, et al. BridgeData V2: A dataset for robot learning at scale. In Conference on Robot Learning (CoRL), 2023

    2023

  14. [22]

    Padalkar, et al

    Open X-Embodiment Collaboration, A. Padalkar, et al. Open X-embodiment: Robotic learning datasets and RT-X models. InIEEE International Conference on Robotics and Automation (ICRA), 2024

    2024

  15. [23]

    Khazatsky, K

    A. Khazatsky, K. Pertsch, S. Nair, et al. DROID: A large-scale in-the-wild robot manipulation dataset.arXiv preprint arXiv:2403.12945, 2024

    2024 arXiv

  16. [24]

    O. Mees, L. Hermann, E. Rosete-Beas, and W. Burgard. CALVIN: A benchmark for language-conditioned policy learning for long-horizon robot manipulation tasks.IEEE Robotics and Automation Letters (RA-L), 7(3): 7327–7334, 2022

    2022

  17. [25]

    James, Z

    S. James, Z. Ma, D. R. Arrojo, and A. J. Davison. RLBench: The robot learning benchmark & learning environment.IEEE Robotics and Automation Letters (RA-L), 5(2):3019–3026, 2020

    2020

  18. [26]

    Nasiriany, A

    S. Nasiriany, A. Maddukuri, L. Zhang, A. Parikh, A. Lo, A. Joshi, A. Mandlekar, and Y . Zhu. RoboCasa: Large-scale simulation of everyday tasks for generalist robots. InRobotics: Science and Systems (RSS), 2024

    2024

  19. [27]

    W. Chen, S. Belkhale, S. Mirchandani, O. Mees, D. Driess, K. Pertsch, and S. Levine. Training strategies for efficient embodied reasoning.arXiv preprint arXiv:2505.08243, 2025

    2025 arXiv

  20. [28]

    Q. Zhao, Y . Lu, M. J. Kim, Z. Fu, Z. Zhang, Y . Wu, Z. Li, Q. Ma, S. Han, C. Finn, A. Handa, M.-Y . Liu, D. Xiang, G. Wetzstein, and T.-Y . Lin. CoT-VLA: Visual chain-of-thought reasoning for vision-language-action models. In IEEE/CVF Conference on Computer Vision and Pattern...

    2025 arXiv

  21. [29]

    J. Wei, X. Wang, D. Schuurmans, M. Bosma, B. Ichter, F. Xia, E. H. Chi, Q. V . Le, and D. Zhou. Chain-of-thought prompting elicits reasoning in large language models. InAdvances in Neural Information Processing Systems (NeurIPS), volume 35, 2022

    2022

  22. [30]

    Schulhoff, J

    S. Schulhoff, J. Pinto, A. Khan, L.-F. Bouchard, C. Si, S. Anati, V . Tagliabue, A. L. Kost, C. Carnahan, and J. Boyd-Graber. Ignore this title and HackAPrompt: Exposing systemic vulnerabilities of LLMs through a global scale prompt hacking competition.arXiv preprint arXiv:231...

    2023 arXiv

  23. [31]

    A. Wei, N. Haghtalab, and J. Steinhardt. Jailbroken: How does LLM safety training fail? InAdvances in Neural Information Processing Systems (NeurIPS), volume 36, 2023

    2023

  24. [32]

    A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson. Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043, 2023

    2023 arXiv

  25. [33]

    Xiang, F

    Z. Xiang, F. Jiang, Z. Xiong, B. Ramasubramanian, R. Poovendran, and B. Li. BadChain: Backdoor chain-of- thought prompting for large language models. InInternational Conference on Learning Representations (ICLR),

  26. [34]

    Jiang, Z

    F. Jiang, Z. Xu, Y . Li, L. Niu, Z. Xiang, B. Li, B. Y . Lin, and R. Poovendran. SafeChain: Safety of language models with long chain-of-thought reasoning capabilities. InAnnual Meeting of the Association for Computational Linguistics (ACL), 2025. arXiv:2502.12025

    2025 arXiv

  27. [35]

    Turpin, J

    M. Turpin, J. Michael, E. Perez, and S. R. Bowman. Language models don’t always say what they think: Unfaithful explanations in chain-of-thought prompting. InAdvances in Neural Information Processing Systems (NeurIPS), volume 36, 2023. 10 Reasoning as a Double-Edged Sword in V...

    2023

  28. [36]

    Q. Lyu, S. Havaldar, A. Stein, L. Zhang, D. Rao, E. Wong, M. Apidianaki, and C. Callison-Burch. Faithful chain-of-thought reasoning. InIJCNLP-AACL, 2023

    2023

  29. [37]

    X. Wang, J. Wei, D. Schuurmans, Q. V . Le, E. H. Chi, S. Narang, A. Chowdhery, and D. Zhou. Self-consistency improves chain of thought reasoning in language models. InInternational Conference on Learning Representations (ICLR), 2023

    2023

  30. [38]

    Q. Gu, Y . Ju, S. Sun, I. Gilitschenski, H. Nishimura, M. Itkina, and F. Shkurti. SAFE: Multitask failure detection for vision-language-action models.arXiv preprint arXiv:2506.09937, 2025

    2025

  31. [39]

    Y . Wu, A. Li, T. Hermans, F. Ramos, A. Bajcsy, and C. Pérez-D’Arpino. Do what you say: Steering vision- language-action models via runtime reasoning-action alignment verification.arXiv preprint arXiv:2510.16281, 2025

    2025

  32. [40]

    X. Li, R. Mao, Y . Zhang, R. Lou, C. Wu, and J. Wang. Chain-of-scrutiny: Detecting backdoor attacks for large language models.arXiv preprint arXiv:2406.05948, 2024

    2024

  33. [41]

    Huang, W

    Z. Huang, W. Zhu, H. Qiu, X. Ji, and W. Xu. TRAP: Hijacking VLA CoT-reasoning via adversarial patches. arXiv preprint arXiv:2603.23117, 2026

    2026 arXiv

  34. [42]

    T. Wang, C. Han, J. C. Liang, W. Yang, D. Liu, L. X. Zhang, Q. Wang, J. Luo, and R. Tang. Exploring the adversarial vulnerabilities of vision-language-action models in robotics. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2025. arXiv:2411.13587

    2025 arXiv

  35. [43]

    J. Guo, Z. Wu, C. Tu, Y . Ma, X. Kong, Z. Liu, J. Ji, S. Zhang, Y . Chen, K. Chen, Q. Dou, Y . Yang, X. Liu, H. Zhao, W. Lv, and S. Li. On robustness of vision-language-action model against multi-modal perturbations. arXiv preprint arXiv:2510.00037, 2025

    arXiv

  36. [44]

    T. D. Trinh, N. Akhtar, and B. Azam. Altered thoughts, altered actions: Probing chain-of-thought vulnerabilities in VLA robotic manipulation.arXiv preprint arXiv:2603.12717, 2026

    2026

  37. [45]

    Szegedy, W

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199, 2014. ICLR 2014

    2014 arXiv

  38. [46]

    I. J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. InInternational Conference on Learning Representations (ICLR), 2015

    2015

  39. [47]

    Kurakin, I

    A. Kurakin, I. Goodfellow, and S. Bengio. Adversarial examples in the physical world. InICLR Workshop, 2017

    2017

  40. [48]

    Carlini and D

    N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. InIEEE Symposium on Security and Privacy (SP), 2017

    2017

  41. [49]

    T. B. Brown, D. Mane, A. Roy, M. Abadi, and J. Gilmer. Adversarial patch.arXiv preprint arXiv:1712.09665, 2017

    2017 arXiv

  42. [50]

    Athalye, N

    A. Athalye, N. Carlini, and D. Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. InInternational Conference on Machine Learning (ICML), 2018

    2018

  43. [51]

    Tramèr, N

    F. Tramèr, N. Carlini, W. Brendel, and A. Madry. On adaptive attacks to adversarial example defenses. In Advances in Neural Information Processing Systems (NeurIPS), 2020

    2020

  44. [52]

    Andriushchenko, F

    M. Andriushchenko, F. Croce, N. Flammarion, and M. Hein. Square attack: a query-efficient black-box adversarial attack via random search. InEuropean Conference on Computer Vision (ECCV), pages 484–501. Springer, 2020

    2020

  45. [53]

    Papernot, P

    N. Papernot, P. McDaniel, and I. Goodfellow. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples.arXiv preprint arXiv:1605.07277, 2016

    2016 arXiv

  46. [54]

    Tramèr, N

    F. Tramèr, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel. The space of transferable adversarial examples. arXiv preprint arXiv:1704.03453, 2017

    2017 arXiv

  47. [55]

    Croce and M

    F. Croce and M. Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. InInternational Conference on Machine Learning (ICML), 2020

    2020

  48. [56]

    Eykholt, I

    K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song. Robust physical-world attacks on deep learning visual classification. InIEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2018

    2018

  49. [57]

    Y . Zhao, T. Pang, C. Du, X. Yang, C. Li, N.-M. Cheung, and M. Lin. On evaluating adversarial robustness of large vision-language models. InAdvances in Neural Information Processing Systems (NeurIPS), 2023

    2023

  50. [58]

    Schlarmann and M

    C. Schlarmann and M. Hein. On the adversarial robustness of multi-modal foundation models. InICCV Workshop on Adversarial Robustness in the Real World, 2023. 11 Reasoning as a Double-Edged Sword in VLAsA PREPRINT

    2023

  51. [59]

    Fazlyab, A

    M. Fazlyab, A. Robey, H. Hassani, M. Morari, and G. J. Pappas. Efficient and accurate estimation of Lipschitz constants for deep neural networks. InAdvances in Neural Information Processing Systems (NeurIPS), volume 32, 2019

    2019

  52. [60]

    T.-W. Weng, H. Zhang, H. Chen, Z. Song, C.-J. Hsieh, D. S. Boning, L. Daniel, and I. S. Dhillon. Towards fast computation of certified robustness for ReLU networks. InInternational Conference on Machine Learning (ICML), 2018

    2018

  53. [61]

    J. M. Cohen, E. Rosenfeld, and J. Z. Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning (ICML), 2019

    2019

  54. [62]

    Wong and J

    E. Wong and J. Z. Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. InInternational Conference on Machine Learning (ICML), 2018

    2018

  55. [63]

    Henderson, R

    P. Henderson, R. Islam, P. Bachman, J. Pineau, D. Precup, and D. Meger. Deep reinforcement learning that matters. Proceedings of the AAAI Conference on Artificial Intelligence, 2018

    2018

  56. [64]

    Agarwal, M

    R. Agarwal, M. Schwarzer, P. S. Castro, A. Courville, and M. G. Bellemare. Deep reinforcement learning at the edge of the statistical precipice. InAdvances in Neural Information Processing Systems (NeurIPS), 2021

    2021

  57. [65]

    Hendrycks and T

    D. Hendrycks and T. G. Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. InInternational Conference on Learning Representations (ICLR), 2019

    2019

  58. [66]

    Tobin, R

    J. Tobin, R. Fong, A. Ray, J. Schneider, W. Zaremba, and P. Abbeel. Domain randomization for transferring deep neural networks from simulation to the real world. InIEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), 2017

    2017

  59. [67]

    X. B. Peng, M. Andrychowicz, W. Zaremba, and P. Abbeel. Sim-to-real transfer of robotic control with dynamics randomization. InIEEE International Conference on Robotics and Automation (ICRA), 2018

    2018

  60. [68]

    Belinkov and Y

    Y . Belinkov and Y . Bisk. Synthetic and natural noise both break neural machine translation. InInternational Conference on Learning Representations (ICLR), 2018

    2018

  61. [69]

    predict action from CoT

    D. Lakens. Equivalence tests: A practical primer for t-tests, correlations, and meta-analyses.Social Psychological and Personality Science, 8(4):355–362, 2018. 12 Reasoning as a Double-Edged Sword in VLAsA PREPRINT Supplementary Material A Extended experimental details Compute...

    2018

  62. [70]

    Direction-adaptive:Entity swap + match directional language in the CoT to the actual action vector direction (e.g., if action moves right, ensure CoT says “right”)

  63. [71]

    Raw SR” is undefended task success; “Def. SR

    Stealth:Entity swap + re-inject the original instruction objects into the corrupted CoT, fooling the entity-matching component. 4.Full adaptive:Combine direction fix and entity re-injection. The stealth variant reduces the entity component AUC from 1.000 to 0.492, demonstratin...

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.