Reasoning as a Double-Edged Sword: Architecture and Cross-Stage Robustness in Vision-Language-Action Models
Tuan Duong Trinh, Naveed Akhtar, Basim Azam
cs.RO, cs.AI, cs.CR, cs.LG
Submitted: 2026-07-20
License: http://creativecommons.org/licenses/by/4.0/
The gist: Does adding a reasoning step make a Vision-Language-Action (VLA) model more robust to perturbation? Intuitively, a policy that reasons before acting should absorb a perturbed input better than one
Terminology
Abstract
Does adding a reasoning step make a Vision-Language-Action (VLA) model more robust to perturbation? Intuitively, a policy that reasons before acting should absorb a perturbed input better than one that maps observations directly to actions. We test this premise head-on across three models that span the reasoning spectrum (no reasoning, a text chain-of-thought, and a latent iterative loop), perturbing each at the vision, reasoning, and action stages on LIBERO and SimplerEnv. Two questions organize the study: does the reasoning design shift robustness, and can the reasoning be read back at runtime as a safety signal? We find that the latent-iterative model is by far the least robust: under both stochastic noise and white-box perturbation its task success collapses, while the other two hold. This fragility is structural rather than cumulative: varying the reasoning depth at inference barely moves it. Reasoning outputs can in principle be monitored, but the monitors fail under fair tests. A plan--action consistency probe that looks near-perfect under naive evaluation falls to chance under adaptive attack. Under matched-FPR calibration, fusing it with an action-anomaly probe never lifts defended success above undefended. Scoped to these output-level behavioral probes under white-box vision-stage attack, this ceiling is a precondition that any viable defense must first satisfy.
Sources
- RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Control
- OpenVLA: An Open-Source Vision-Language-Action Model
- $\pi_0$: A Vision-Language-Action Flow Model for General Robot Control
- Robotic Control via Embodied Chain-of-Thought Reasoning
- DeepThinkVLA: Enhancing Reasoning Capability of Vision-Language-Action Models
- Recurrent-Depth VLA: Implicit Test-Time Compute Scaling of Vision-Language-Action Models via Latent Iterative Reasoning
- LIBERO-Plus: In-depth Robustness Analysis of Vision-Language-Action Models
- Fine-Tuning Vision-Language-Action Models: Optimizing Speed and Success
- LIBERO: Benchmarking Knowledge Transfer for Lifelong Robot Learning
- Evaluating Real-World Robot Manipulation Policies in Simulation
- On Evaluating Adversarial Robustness
- $\pi_{0.5}$: a Vision-Language-Action Model with Open-World Generalization
- FAST: Efficient Action Tokenization for Vision-Language-Action Models
- RDT-1B: a Diffusion Foundation Model for Bimanual Manipulation
- Octo: An Open-Source Generalist Robot Policy
- DROID: A Large-Scale In-The-Wild Robot Manipulation Dataset
- Training Strategies for Efficient Embodied Reasoning
- CoT-VLA: Visual Chain-of-Thought Reasoning for Vision-Language-Action Models
- Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs through a Global Scale Prompt Hacking Competition
- Universal and Transferable Adversarial Attacks on Aligned Language Models
Related papers
- FMT x: An Efficient and Asymptotically Optimal Extension of the Fast Marching Tree for Dynamic Replanning
- MPCFormer: A physics-informed data-driven approach for explainable socially-aware autonomous driving
- RoboLab: A High-Fidelity Simulation Benchmark for Analysis of Task Generalist Policies
- HRDexDB: A 4D Dexterous Grasping Dataset Across Human and Multiple Robot Embodiments
- APT: Action Expert Pretraining Improves Instruction Generalization of Vision-Language-Action Policies
- Fine-tuning is Not Enough: A Parallel Framework for Collaborative Imitation and Reinforcement Learning in End-to-end Autonomous Driving