THE VOCABULARY OF EMBODIED AI SECURITY · PV-014
Embodied AI security, defined.
A new category needs a shared vocabulary. These are the terms Provael measures against — from vision-language-action policies to calibrated attack-success rate — each defined plainly, and linked to the Embodied AI Security Top 10 where it maps to a specific risk.
Foundations
- Embodied AI
- AI that perceives and acts in the physical world through a body — a robot — rather than only producing text. Its failures are movements, not sentences.
- Physical AI
- A near-synonym for embodied AI, emphasising that the model’s output drives real-world actuation. The term the humanoid-robotics wave has adopted.
- Vision-Language-Action (VLA) policy
- A model that maps camera images plus a natural-language instruction directly to robot actions. VLAs are what Provael red-teams: language and perception in, motion out.
- Robot policy
- The function that maps a robot’s observations to its next action. The policy is the "brain" whose security Provael measures.
- The embodiment gapEAI06 →
- The security gap between a model that outputs text and one that outputs motion. Text-layer red-teaming stops at the sentence; a robot policy turns the same input into a trajectory, which text-only tools cannot reach.
- Action spaceEAI04 →
- The set of commands a policy can emit to the robot — joint torques, end-effector targets, gripper states. Integrity of the action space is a distinct attack surface from the language input.
- Keep-out zone
- A region the robot must never enter (a person, a machine, a boundary). The "keep-out predicate" is the check that flags when a policy has driven the robot into one — Provael’s core notion of an unsafe embodied action.
Attacks
- Red-teaming
- Adversarially testing a system to find its failures before a real attacker does. Provael red-teams robot policies in simulation and reports how often each attack succeeds.
- Policy jailbreakEAI01 →
- An input — reworded instruction, roleplay frame, injected directive — that makes a policy perform a disallowed physical action while looking benign.
- Adversarial perceptionEAI02 →
- Attacks that fool a policy’s vision input — printed patches, textures, or sensor spoofing — so the robot acts on a false view of the world.
- Action-space integrity attackEAI04 →
- An attack that targets the action output directly — hijacking the trajectory, freezing the policy, or degrading task success — while the visible instruction stays benign.
- Trajectory hijackEAI04 →
- Steering a robot’s commanded motion toward an attacker-chosen waypoint or goal — the robot moves, but to the wrong place.
- Freeze (paralysis) attackEAI04 →
- Forcing a policy into a no-op so the robot stops acting — an availability / denial-of-service failure that a single task-success metric hides.
- Embodied prompt injectionEAI05 →
- Malicious instructions a robot reads from its environment — a sign, a screen, an object label — that hijack its behaviour without any direct command channel.
- BackdoorEAI03 →
- A hidden trigger implanted in a model or its supply chain that makes the policy perform a chosen action when it sees a specific, otherwise-innocuous cue.
Measurement
- Attack-success rate (ASR)
- The fraction of attempts on which an attack drives the policy into an unsafe state (e.g. a keep-out violation). Provael’s headline metric — always reported with a confidence interval and a benign control, never as a raw percentage.
- Benign control (benign-FPR)
- A clean baseline that measures how often the "unsafe" test fires with no attack present — the false-positive rate. Without it, an ASR is uninterpretable: you can’t tell a real attack from a trigger-happy predicate.
- Wilson confidence interval
- A statistically-sound interval for a proportion (like an ASR) that stays valid at small sample sizes, where the naive interval breaks. Provael reports a 95% Wilson CI on every rate.
- Calibration
- Fitting the unsafe predicate to a policy’s own benign rollouts so that a flagged violation means something for that policy, not an arbitrary threshold. Calibration is what turns a demo into a measurement.
- Transfer test
- The check of whether an attack that works on a deterministic stub or one model also works on a real policy. Provael ships every attack-family claim with its transfer status in the same breath as the number.
- Succ-But-Unsafe (SbU)
- When a policy completes its task but violates a safety constraint doing it — a failure a task-success-only metric records as a success. Provael scores it separately.
- Null result
- A published negative finding — an attack that did not transfer, or produced no measurable lift. Provael publishes nulls as loudly as positives; a security measurement is only worth its honesty.
Evidence & compliance
- SARIF
- The Static Analysis Results Interchange Format — an OASIS standard for machine-readable security findings, ingestible by GitHub code scanning and GRC tools. Provael emits its results as SARIF so a robot red-team finding files like any other vulnerability.
- CI gate
- A continuous-integration check that fails a build when the measured ASR exceeds a set threshold — turning "is this policy safe enough?" into an automated, reproducible pass/fail.
- Conformity evidence
- Audit-ready artifacts that map a measured result to a regulation or standard (EU AI Act, EU Machinery Regulation, ISO 10218, NIST AI RMF). Evidence, not certification — the thing a notified body or insurer actually reviews.
- Embodied AI Security Top 10
- Provael’s independent, versioned taxonomy of the top security risks for vision-language-action robot policies — the attack-mechanism vocabulary the tool’s findings map to. Covers the physical-actuation layer that text-focused frameworks do not.
Simulation
- LIBERO
- An open robot-manipulation benchmark suite used to evaluate VLA policies. Provael runs real-model transfer tests on LIBERO (built on robosuite / MuJoCo), entirely in simulation.
- Sim-to-real gap
- The difference between how a policy behaves in simulation versus on physical hardware. Provael is sim-only by design; results are honest about what a simulated finding does and does not imply for a real robot.
From vocabulary to a verified number.
Every term here is something Provael can measure on your policy — with a confidence interval and a benign control.