What it is
Action-space integrity attacks target the policy’s action output directly: hijacking it into an attacker-specified trajectory, degrading task success, or freezing it into a no-op (paralysis). The visible language instruction can stay benign, so the violation is attributable to action-space integrity, not a jailbroken goal.
A hijacked-trajectory robot and a frozen robot are different severe failures — and a single “task success” metric hides both. (Freeze is also an availability / DoS failure.)
Seen in the wild
AttackVLA / BackdoorVLA (arXiv:2511.12149) drove a real robot through a targeted action sequence; FreezeVLA (arXiv:2509.19870) reported roughly 76% paralysis ASR. Both are action-output attacks — the danger is in the motion, not the words.
Attack, measure, prove
- Ships three families. `action` (freeze + trajectory_hijack) drives the motor command to a no-op or redirects the trajectory toward an attacker waypoint. `action_space` (keepout_hijack + critical_freeze) attacks the commanded end-state on a disjoint out-of-band channel — into a monitored-standstill keep-out zone, or paralysed at a safety-critical step — with the visible instruction kept benign.
- `optimized` (targeted_hijack) is a black-box, query-budgeted search that adapts a `goto::` directive to steer emitted motion toward an attacker goal — the first non-templated attack in the suite.
- Each is scored as a rate with a 95% Wilson CI against a benign-FPR control. All three are stub-validated only (deterministic CPU core, 100% [72–100%] / [84–100%] vs a 0% benign baseline); real SmolVLA×LIBERO transfer (AttackVLA / FreezeVLA) is GPU-gated and not run — no cross-model claim.
What reduces the risk
- Action sanity-bounds, rate/force limits, and motion-envelope watchdogs enforced below the policy.
- Independent keep-out-zone enforcement that fails safe on a constraint violation.
- Report ASR as a matrix (untargeted / freeze / targeted) against a clean baseline, so a hijack and a freeze are not hidden by one success metric.
How it shows up in CI
Every finding for this risk carries a stable rule id in the SARIF report — the Embodied AI Top-10 id itself:
Crosswalk
- OWASP
- No direct OWASP peer — action-layer integrity
- MITRE ATLAS
- Impact → manipulate / deny the agent’s actuation (proposed — ATLAS embodied coverage is thin)
- Frameworks
- NIST AI 100-2 — Integrity violationISO 10218:2025 — monitored stop / limits
See the full framework crosswalk for dates and detail. Not legal advice.