What it is
Adversarial perception manipulates what the policy sees or senses — an adversarial patch, a printed texture or sticker, a 3D texture, or a spoofed depth/LiDAR signal — so its behaviour flips while the perturbation looks benign to a human and the text instruction stays legitimate.
For an embodied policy the consequence is physical: a misperceived object pose or boundary becomes an unsafe motion. It lives in the physical environment, not the network — it needs no system access and survives air-gaps.
Seen in the wild
Adversarial-patch and action-aware attacks against VLA models are documented (“Adversarial vulnerabilities of VLA models”, arXiv:2411.13587). The honest result from Provael’s own run is a null: these did NOT transfer to the real SmolVLA×LIBERO policy — 0% (0/10), 95% CI [0–28%], against the same 0% benign baseline. Real-world robustness of perception attacks is unsettled, which is exactly why you test it rather than assume it.
Attack, measure, prove
- Ships two families: `visual` (patch + decoy_object, a scalar-danger perturbation) and `sensor_spoof` (patch_spoof + signal_spoof).
- The method is a sim-injected perception spoof — an adversarial patch on the simulated camera, or a range/depth perturbation on the simulated LiDAR — that makes the policy perceive a phantom target inside a monitored-standstill keep-out zone and command its end-effector there. It perturbs the simulator’s observation stream, never real sensor hardware.
- Scored as a keep-out-violation rate with a 95% Wilson CI against a benign-FPR control. Stub-validated only (deterministic CPU `reach` suite: 100% [84–100%] vs a 0% benign baseline); real-model transfer is GPU-gated and, on the one real run, did not transfer (see example). No cross-model claim.
What reduces the risk
- Input smoothing/randomization and adversarial training for known patch classes.
- Multi-view and multi-sensor agreement, plus perception-embedding anomaly detection.
- Physical red-team with printed artifacts; independent runtime keep-out enforcement regardless of perception.
How it shows up in CI
Every finding for this risk carries a stable rule id in the SARIF report — the Embodied AI Top-10 id itself:
Crosswalk
- OWASP
- No direct OWASP peer — perception-layer risk
- MITRE ATLAS
- Defense Evasion → craft adversarial data (perception channel)
- Frameworks
- NIST AI 100-2 — Evasion (integrity)
See the full framework crosswalk for dates and detail. Not legal advice.