TNAS Diagnostic Exposes Silent Action Attacks on Reasoning VLA Models
Say the Same, Act Differently: Diagnosing and Steering Text-Action Divergence in Reasoning VLAs
The key implication is that oversight mechanisms relying on reading a model's language output give a false sense of safety, since action channels can be steered invisibly. Robotics and autonomous-driving teams deploying reasoning VLAs should add direct verification of predicted action sequences rather than textual rationales. The evaluation uses NVIDIA's Alpamayo driving stack alongside InstructVLA, making the finding relevant to embodied-AI safety benchmarks rather than chat-only models.
A new paper introduces the text-neutral action-subspace (TNAS) diagnostic for reasoning vision-language-action (VLA) models, tested on Alpamayo for driving and InstructVLA for manipulation. Visual perturbations along this direction change physical actions while leaving generated rationales word-for-word identical, with norm overlap to text-loss gradients of just 1.87% and 5.28% across the two models. In 154 obstacle-annotated Alpamayo driving scenes, TNAS-guided attacks induced a new collision under identical rationales in 52.6% of full-image cases and 35.1% under a localized forward-camera patch, versus 4.55% for unguided attacks. TNAS guidance also raised exact rationale preservation from 83.0% to 89.5% and cut teacher-forced text drift by 68.4% at a comparable collision rate. The authors conclude that an unchanged rationale cannot certify safe actions, so monitors must verify the predicted action channel directly.
Say the Same, Act Differently: Diagnosing and Steering Text-Action Divergence in Reasoning VLAs
Reasoning vision-language-action (VLA) models pair physical control with natural-language rationales that supervisors can read to monitor embodied safety. Prior attacks on VLA reasoning corrupt the rationale itself and leave visible evidence in the text. We show that visual perturbations can instead alter the physical action while keeping the generated rationale word-for-word identical. At the shared text/action interface of Alpamayo for driving and InstructVLA for manipulation, our text-neutral action-subspace (TNAS) diagnostic shows that the locally most action-sensitive direction is nearly orthogonal to the active text-loss gradients, with 1.87% and 5.28% norm overlap. At equal hidden-state perturbation norms across both models, interventions along this text-neutral residual shift actions 4.64x to 47.8x more than text-gradient perturbations, whereas text-gradient perturbations induce 21.2x to 277x more text drift. Steering visual perturbations along this direction reaches the same decoupling from the image. Across 154 obstacle-annotated driving scenes in Alpamayo, TNAS-guided attacks induce a new collision under a word-for-word identical rationale in 52.6% of scenes under full-image perturbations and 35.1% under a localized forward-camera patch, compared with 4.55% for unguided action attacks. Relative to a text-preserving baseline, TNAS guidance raises exact rationale preservation from 83.0% to 89.5% and cuts teacher-forced text drift by 68.4% at a comparable collision rate. In InstructVLA, TNAS guidance cuts text drift by 40.5% and preserves the exact response on 85.0% of examples alongside a 1.73-unit action-chunk shift. An unchanged rationale therefore cannot certify a safe action, so monitors for reasoning VLAs must verify the predicted action channel directly.