Pith. sign in

REVIEW 3 major objections 7 minor 7 cited by

Adversarial Attacks on Robotic Vision Language Action Models

T0 review · 3 major / 7 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that adversarial text prompts give an attacker complete control authority over a vision-language-action robot: optimized instructions elicit targeted actions at 77–98% success and persist up to 28× longer than nominal…

desk verdict Solid first attack on low-level VLA actuators with honest experiments, but the 'complete control authority' claim is overreach given the one-hot-only evidence. read the letter →

arxiv 2506.03350 v1 pith:WZVXDZLP submitted 2025-06-03 cs.RO cs.AI

Eliot Krzysztof Jones , Alexander Robey , Andy Zou , Zachary Ravichandran , George J. Pappas , Hamed Hassani , Matt Fredrikson , J. Zico Kolter This is my paper
classification cs.ROcs.AI
keywords adversarialattacksvision-language-actionmodelsjailbreakingGCGrobotcontrolpromptoptimizationauthorityOpenVLA
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that vision-language-action models (VLAs)—policies that map an image and a text instruction directly to low-level motor commands—are vulnerable to the same kind of token-level adversarial prompting used to jailbreak large language models. The authors adapt the GCG suffix-optimization algorithm to the robotic setting and show that a short adversarially optimized instruction can elicit nearly any targeted action from OpenVLA fine-tunes: overall success rates are 96.5%, 93.8%, 97.5%, and 77.3% on the four LIBERO benchmarks they test, with per-dimension rates mostly above 90%. These attacks are applied once at the start of a rollout and still persist as the robot sees new images, increasing the number of targeted persistence steps by up to 28× relative to nominal behavior. The broader claim is that safety for VLA-controlled robots should be understood as control authority rather than semantic harm: an adversary does not need to make the model say something harmful, only to make it actuate a chosen command. If true, any deployment that trusts the natural-language instruction channel of a VLA is exposed to takeover by a text-only adversary.

What carries the argument

The load-bearing object is an adapted Greedy Coordinate Gradient (GCG) attack. GCG treats the instruction as a discrete token sequence and, at each step, replaces the token whose gradient estimate most reduces the loss; here the loss is the negative log-likelihood of a length-d target action token sequence, where d is the robot's degrees of freedom, conditioned on both the text and the current image embedding. The adaptation works because VLA architectures use symbol tuning, reserving a subset of rarely used vocabulary tokens as a discretized action code, so an action is literally a token sequence that the same autoregressive machinery can be optimized toward. The persistence variant sums this loss over r different image embeddings to make the attack invariant to visual input, which is what lets a single prompt survive changing observations.

What would settle it

Run the single-step attack on a random sample of targets drawn from the full $256^{7}$ discretized action space rather than from the 7×256 one-hot set; if overall success on these multi-dimensional targets is far below the 77–98% reported for one-hot targets, the reachability claim is refuted. A first step would be testing two-hot or three-hot targets to see whether success degrades smoothly with the number of nonzero dimensions.

Watch

Extended reading notes

Core claim

The central discovery is that the action space of a VLA is reachable through its text input. For each of four OpenVLA fine-tunes, the paper optimizes token positions in the instruction to minimize the negative log-likelihood of a targeted action token sequence, and finds that 77–98% of one-hot target actions—one action dimension nonzero, chosen from 256 bins per dimension—are elicited exactly. Attack efficiency is high: successful matches are found in 30–110 GCG optimization steps, versus the full 500-step budget commonly needed for chatbot jailbreaks. The persistence variant optimizes the instruction against several image embeddings at once, and the resulting attack keeps producing the target action on later, unseen images, up to 28× the nominal baseline on the Libero-Spatial fine-tune. The authors conclude that adversarial prompting alone grants complete control authority over a target VLA, and that architecture transfer is the main limitation: optimized suffixes perform no better than random token strings on TraceVLA, CogACT, and OpenPi0, while universal suffixes trained on two source models show only measurable, uncorrelated effects.

Load-bearing premise

The load-bearing premise is that success on targets where only one of the seven action dimensions takes a nonzero value generalizes to the full space of combined motions; if realistic multi-dimensional actions are much harder to elicit, the 'nearly any action' and 'complete control authority' conclusions weaken.

Editorial extensions

If this is right

  • A text-only adversary can trigger specific low-level motor commands from an autoregressive VLA, so instruction channels should be treated as untrusted inputs in any safety analysis.
  • Single-step attacks are cheap enough to matter operationally: successful suffixes are found in 30–110 optimization steps, about 3–10 minutes on an H100 GPU.
  • Task-specific fine-tuning amplifies vulnerability: attack success on the four fine-tunes is 40–60% higher than on the OpenVLA base model, suggesting that fine-tuning concentrates the action distribution.
  • Persistence attacks separate the attack channel from the perception channel: one prompt can steer a policy across multiple steps even as the camera input changes.
  • The defense results show that language-only perplexity filtering blocks the tested suffix attacks, but its threshold depends on held-out instruction statistics that are not knowable in advance for open-world robots; smoothing also blocks attacks but destroys nominal task performance.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: if action spaces are this reachable by tokens, then instruction sanitization for VLA robots becomes a control problem—defenses must bound worst-case reachable actions, not just filter for semantic harm.
  • Editorial inference: because attack success is a numerical match rather than a judged semantic response, VLA red-teaming can be automated more straightforwardly than chatbot jailbreaking; a continuous benchmark over target-action grids would be a natural extension.
  • Editorial inference: the persistence objective suggests a testable scaling path—optimizing against a learned distribution of future image embeddings, rather than r sampled images, may extend single-prompt attacks to arbitrary horizon lengths.
  • Editorial inference: the weak architecture transfer implies that attackers would need per-model or ensemble optimization; a practical mitigation could therefore be diversity in VLA architectures within a fleet, though this is not a defense the paper evaluates.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The manuscript adapts the GCG token-level jailbreak attack to vision-language-action models (VLAs), optimizing an adversarial textual suffix or instruction to maximize the likelihood of a targeted action token sequence. Experiments on four OpenVLA fine-tunes from LIBERO report single-step attack success over a grid of 1,792 one-hot target actions, persistence attacks over multi-step rollouts with seen and unseen images, transfer experiments across other VLA architectures and environments, and candidate defenses. The authors conclude that adversarial prompting yields complete control authority over a VLA and facilitates full reachability of the action space, and they release code.

Significance. If the reachability claim were established, this would be an important first study of adversarial attacks against low-level VLA actuators, with direct relevance to robot safety. The paper's concrete strengths are the careful one-hot attack evaluation across four fine-tunes with nominal and random baselines, the honest null transfer analysis in Section 4.3 and Appendix B, the persistence evaluation that separates seen from unseen images, and the public code release. The central weakness is that the headline claim extends beyond the evidence: only 1,792 one-hot targets are tested, so 'full reachability' and 'complete control authority' are not supported for the full 256^7 joint action space.

major comments (3)
  1. [Section 4.1, Table 1, Abstract, Conclusion] The claim that attacks facilitate 'full reachability of the action space' and provide 'complete control authority' rests entirely on 1,792 one-hot target vectors (7 dimensions x 256 bins). These targets fix six dimensions to zero and are not a representative sample of the 256^7 joint action space, and no experiment optimizes or even evaluates a multi-dimensional joint target. The paper itself justifies the one-hot grid by saying many multi-dimensional actions are physically unrealizable or out-of-distribution, which means the evidence cannot support 'nearly any targeted action' without either testing joint targets (e.g., sparse random joint actions or actions drawn from held-out trajectories) or explicitly limiting the claim to one-hot axis-aligned targets.
  2. [Appendix C.1 and Section 3.4] The q01/q99 normalization clipping means many of the 256 nominal bins map to the same normalized action value. Appendix C.1 states that for Libero-10 dimension 3, almost all 128 actions between 0 and -1 collapse to the same q01 value, so those trials are effectively repeated optimizations of the same target. This makes the effective test set smaller and less diverse than 1,792, and the failure clustering in Figure 6 shows that some regions are not reached. The reported per-dimension success rates therefore overstate coverage of the discretized action space; the paper should report the number of distinct normalized targets actually tested and the success rate restricted to those distinct targets.
  3. [Section 4.1, Table 2, Contribution bullet 'Universality'] The claim that attacks can be 'successfully deployed across multiple robotic environments, both in simulation and in the real world' overstates the evidence. The experiments optimize attack suffixes on images and evaluate them offline against image embeddings; no physical robot rollout is performed. In addition, the SIMPLER column shows an overall ASR of 38.0%, numerically identical to the OpenVLA base model's one-hot attack success rate reported in Appendix A, so calling this 'relatively strong performance' is misleading without a baseline comparison. Please either temper the universality claim, provide a real-robot demonstration, or clarify what the SIMPLER numbers are compared against.
minor comments (7)
  1. [Section 5] The text 'user-defined preplexity threshold' should read 'perplexity threshold'.
  2. [Equation (1)] The subscript on the conditioning context, 'x_n+1:nj-1', is unclear; please rewrite it as a standard autoregressive conditioning index.
  3. [Appendix A] The sentence 'recording our overall success rate of only 38% (see Table 2)' points to the wrong table; Table 2 reports HYDRA and SIMPLER results, not the base-model evaluation described in Appendix A.
  4. [Section 4.1] The phrase 'the middle bar ground' appears to be a typo for 'the middle bar group' or 'the middle panel' and should be corrected for readability.
  5. [Section 4.2 / Figure 2] The caption and axis labels of Figure 2 are dense: 'Number of attack images' and 'Persistence type Seen Unseen Nominal' should be expanded so that the reader can distinguish the r=1,2,3 conditions and the seen/unseen shading without referring to the body text.
  6. [Section 4 (open paragraph)] The phrase 'each action space comprises 7 256 distinct actions' renders as '7 256'; it should read '256^7'.
  7. [Table 3] The text says smoothing 'corrupts the instructions, resulting in a 0% success rate on non-attacked tasks,' but the table only reports ASR; please include the clean-task success rate in the table so the reader can verify this trade-off.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack results are measured against held-out target actions with explicit seen/unseen separation, and the central claims are established by the paper's own experiments rather than by construction.

full rationale

The derivation chain is not circular. Equation (2) is a standard test-time loss over prompt tokens, and the attack success metrics require exact token-level matches to target actions that were never used to train the models; no fitted parameter is renamed as a prediction. The persistence setup (Eq. (4), Fig. 2) is the only place where the images used in the optimization objective coincide with evaluation images, and the paper explicitly separates seen images (hatched) from unseen images, reporting generalization to unseen rollout steps rather than concealing the distinction. Transfer experiments (Section 4.3) report that optimized instructions do no better than random instructions for cross-architecture targets, a negative result that would be unlikely if the evaluation were forced by construction. Self-citations to GCG [20] and to prior LLM-planner jailbreaking [29] provide algorithmic provenance and related work; they are not used to establish the VLA attack's validity, which rests on external benchmarks (OpenVLA fine-tunes, LIBERO, SIMPLER, HYDRA/Open-X) and nominal/random baselines. The one-hot-target-only evaluation and q01/q99 normalization clipping (Appendix C.1) narrow how broadly 'complete control authority' can be inferred, but this is an external-validity or correctness limitation, not an instance of the conclusion reducing to its inputs by construction.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The central claim depends on attacker capabilities (text modification, white-box model access) and on the experimental proxy (one-hot discretized actions) standing in for full continuous control. No new fitted constants or physical entities are introduced; the hand-chosen token and image budgets affect the reported success rates but are attack hyperparameters rather than model parameters.

free parameters (3)
  • Adversarial token budget |I| = 20 (main), 5/10/15 (ablation)
    Headline success rates (Table 1) use 20 optimized tokens; Figure 3 shows success degrades with smaller budgets, so this hand-chosen budget is load-bearing for the reported >90% ASR.
  • Persistence image budget r = 1, 2, or 3
    Eq. (4) aggregates r image embeddings; the 28x persistence improvement is reported for r=3 on Libero-Spatial, so the headline persistence result depends on this chosen budget.
  • One-hot target grid = 7 x 256 = 1792 targets
    The reachability claim is measured only on these extreme/degenerate targets, which are easier to elicit than general combined actions; this selection is load-bearing for the 'any action' claim.
assumptions (3)
  • domain assumption The attacker can modify the textual prompt by appending a suffix or replacing the instruction.
    Threat model in Section 3.2; the entire attack surface is defined by this assumption.
  • domain assumption The attacker has white-box access to VLA weights and the image embeddings z.
    GCG optimization in Eq. (3) requires gradients through the model; the paper lists this as a limitation in Section 6.
  • domain assumption The 256-bin discretized action space, with quantile-based normalization, faithfully represents the robot's continuous action space.
    Introduced in Section 3.2 and used to define targets and success in Section 4; if discretization is not faithful, claims of control authority may not transfer to physical robots.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Attacks on Robotic Vision Language Action Models." pith.science (2026). https://pith.science/paper/WZVXDZLP

@misc{pith2026250603350,
  author       = {Pith},
  title        = {Pith review of: Adversarial Attacks on Robotic Vision Language Action Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WZVXDZLP}},
  note         = {Machine review of arXiv:2506.03350}
}
read the original abstract

The emergence of vision-language-action models (VLAs) for end-to-end control is reshaping the field of robotics by enabling the fusion of multimodal sensory inputs at the billion-parameter scale. The capabilities of VLAs stem primarily from their architectures, which are often based on frontier large language models (LLMs). However, LLMs are known to be susceptible to adversarial misuse, and given the significant physical risks inherent to robotics, questions remain regarding the extent to which VLAs inherit these vulnerabilities. Motivated by these concerns, in this work we initiate the study of adversarial attacks on VLA-controlled robots. Our main algorithmic contribution is the adaptation and application of LLM jailbreaking attacks to obtain complete control authority over VLAs. We find that textual attacks, which are applied once at the beginning of a rollout, facilitate full reachability of the action space of commonly used VLAs and often persist over longer horizons. This differs significantly from LLM jailbreaking literature, as attacks in the real world do not have to be semantically linked to notions of harm. We make all code available at https://github.com/eliotjones1/robogcg .

Figures

Figures reproduced from arXiv: 2506.03350 by the authors.

Figure 1
Figure 1. Adversarial attacks on VLAs. VLA architectures fuse input images and textual task descriptions to produce low-level actuation. In this paper, we show that we can subvert the actions produced by an unattacked VLA (left) by adversarially attacking the textual prompt, resulting in the elicitation of a targeted action or sequence of actions (right). Existing VLAs cast robotic control through the lens of autoregressive p… view at source ↗
Figure 2
Figure 2. Persistence attacks. For each of the four OpenVLA fine-tunes considered in [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 4
Figure 4. Ensemble transfer results. We find that ensemble attacks have a relatively uncorre￾lated, yet nontrivial effect on transferability. 4.1 Single-step attacks Given the effectiveness of VLAs fine-tuned on downstream task data, we begin our evaluation with four fine-tuned versions of OpenVLA [1], the most widely used open-source VLA. Each variant is fine-tuned on a different Libero subset: Libero-Goal, Libero-Object, Li… view at source ↗
Figures from the paper (6 more)
Figure 3
Figure 3. Figure 3: Token budget ablation. We observe that as the attacker’s token bud￾get increases, the success rate also tends to increase. However, there is not a clear correlation between the token budget and the average number of steps per success. On H100 GPUs, this translates to b…
Figure 5
Figure 5. Figure 5: Attacking fine-tuned vs. base VLAs. Each bar shows the percent change in the single step access rate of each OpenVLA fine-tune relative to analogous attacks on the OpenVLA base model. Both the overall and per-dimension success rates show a similar trend: single step at…
Figure 6
Figure 6. Figure 6: Visualizing single step success rates. As we use one-hot target actions in the evaluation of single step attacks in §4.1, we can visualize the locations at which the attack fail. In particular, the x-axis of these plots shows the action dimensions, and the y-axis shows…
Figure 7
Figure 7. Figure 7: Transfer attacks. By optimizing an instruction for OpenVLA-Base, and then attempt transfer to each of TraceVLA, CogACT, and OpenPi0, we evaluate the effectiveness of transferable attacks. Our results show that there is little to no transfer between OpenVLA-Base and oth…
Figure 8
Figure 8. Figure 8: Average action for samples where GCG did not converge [PITH_FULL_IMAGE:figures/full_fig_p020_8.png]
Figure 9
Figure 9. Figure 9: Average action for samples where GCG did converge [PITH_FULL_IMAGE:figures/full_fig_p020_9.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 7 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. TRAP: Hijacking VLA CoT-Reasoning via Adversarial Patches

    cs.CR 2026-03 conditional novelty 7.5 of 10

    Physical adversarial patches can steer CoT-reasoning VLAs into attacker-specified manipulation behaviors without changing the user’s instruction.

  2. DRIFT: Derailing Denoising Trajectories of Flow-Matching VLAs with Adversarial Patch Attack

    cs.CV 2026-08 conditional novelty 6.0 of 10

    A test-time universal patch that perturbs only the first denoising step of a frozen flow-matching VLA derails nearly all LIBERO tasks, outperforming wider-step and action-space attacks.

  3. Safety in Embodied AI: A Survey of Risks, Attacks, and Defenses

    cs.CR 2026-03 unverdicted novelty 6.0 of 10

    The survey organizes over 400 papers on embodied AI safety into a multi-level taxonomy and flags overlooked issues such as fragile multimodal fusion and unstable planning under jailbreaks.

  4. High-Entropy Tokens as Multimodal Failure Points in Vision-Language Models

    cs.CV 2025-12 unverdicted novelty 6.0 of 10

    High-entropy tokens act as concentrated multimodal failure points in VLMs, enabling sparse Entropy-Guided Attacks that achieve 93-95% success and 30-38% harmful rates with cross-model transfer.

  5. Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluation

    cs.CR 2026-07 conditional novelty 5.5 of 10

    World-model-based embodied AI creates a predictive security boundary where attacks on data, sensors, imagination, ranking, and feedback can turn into unsafe physical action and false safety certificates.

  6. VLAGuard: A Framework for Evaluating and Mitigating Physical Attention Hijacking in Vision-Language-Action Robots within Wireless Sensor Networks

    cs.RO 2026-08 conditional novelty 5.0 of 10

    APFT fine-tuning reduces OpenVLA failure under attention-hijacking patches from 100% to 25.9% in simulation and raises real-world success from 23.0% to 67.4%.

  7. Embodied AI: Emerging Risks and Opportunities for Policy Action

    cs.CY 2025-08 conditional novelty 4.0 of 10

    A policy analysis arguing that embodied AI risks are real, under-covered by current US/EU/UK frameworks, and best handled through certification, benchmarks, clarified liability, and economic adaptation.

Reference graph

Works this paper leans on

95 extracted references · 13 canonical work pages · cited by 7 Pith papers

  1. [1]

    Surgical robot transformer (srt): Imitation learning for surgical tasks

    Ji Woong Kim, Tony Z Zhao, Samuel Schmidgall, Anton Deguet, Marin Kobilarov, Chelsea Finn, and Axel Krieger. Surgical robot transformer (srt): Imitation learning for surgical tasks. arXiv preprint arXiv:2407.12998, 2024. 1, 3, 6, 7

    arXiv 2024

  2. [2]

    General-purpose foundation models for increased autonomy in robot-assisted surgery.Nature Machine Intelligence, pages 1–9, 2024

    Samuel Schmidgall, Ji Woong Kim, Alan Kuntz, Ahmed Ezzat Ghazi, and Axel Krieger. General-purpose foundation models for increased autonomy in robot-assisted surgery.Nature Machine Intelligence, pages 1–9, 2024. 1

    2024

  3. [3]

    Real-time anomaly detection and reactive planning with large language models

    Rohan Sinha, Amine Elhafsi, Christopher Agia, Matthew Foutter, Edward Schmerling, and Marco Pavone. Real-time anomaly detection and reactive planning with large language models. arXiv preprint arXiv:2407.08735, 2024. 1

    arXiv 2024

  4. [4]

    Dolphins: Multimodal language model for driving

    Yingzi Ma, Yulong Cao, Jiachen Sun, Marco Pavone, and Chaowei Xiao. Dolphins: Multimodal language model for driving. InEuropean Conference on Computer Vision, pages 403–420. Springer, 2025. 1

    2025

  5. [5]

    GPT-4 as an Agronomist Assistant? Answering Agriculture Exams Using Large Language Models

    Bruno Silva, Leonardo Nunes, Roberto Estevão, Vijay Aski, and Ranveer Chandra. Gpt-4 as an agronomist assistant? answering agriculture exams using large language models.arXiv preprint arXiv:2310.06225, 2023. 1

    work page Pith review arXiv 2023

  6. [6]

    Large language models can help boost food production, but be mindful of their risks.Frontiers in Artificial Intelligence, 7: 1326153, 2024

    Djavan De Clercq, Elias Nehring, Harry Mayne, and Adam Mahdi. Large language models can help boost food production, but be mindful of their risks.Frontiers in Artificial Intelligence, 7: 1326153, 2024. 1

    2024

  7. [7]

    Master plan

    Figure. Master plan. https://www.figure.ai/master-plan, 2022. Accessed: 2025-01-06. 1

    2022

  8. [8]

    Unitree go2

    Unitree Robotics. Unitree go2. https://shop.unitree.com/products/unitree-go2,

Show all 95 references
  1. [9]

    π0: A vision-language-action flow model for general robot control, 2024

    Kevin Black, Noah Brown, Danny Driess, Adnan Esmail, Michael Equi, Chelsea Finn, Niccolo Fusai, Lachy Groom, Karol Hausman, Brian Ichter, Szymon Jakubczak, Tim Jones, Liyiming Ke, Sergey Levine, Adrian Li-Bell, Mohith Mothukuri, Suraj Nair, Karl Pertsch, Lucy Xiaoyang Shi, Jam...

    2024 arXiv

  2. [11]

    Mobility vla: Multimodal instruction navigation with long-context vlms and topological graphs.arXiv preprint arXiv:2407.07775, 2024

    Hao-Tien Lewis Chiang, Zhuo Xu, Zipeng Fu, Mithun George Jacob, Tingnan Zhang, Tsang- Wei Edward Lee, Wenhao Yu, Connor Schenck, David Rendleman, Dhruv Shah, et al. Mobility vla: Multimodal instruction navigation with long-context vlms and topological graphs.arXiv preprint arX...

    2024 arXiv

  3. [12]

    Autort: Embodied foundation models for large scale orchestration of robotic agents.arXiv preprint arXiv:2401.12963, 2024

    Michael Ahn, Debidatta Dwibedi, Chelsea Finn, Montse Gonzalez Arenas, Keerthana Gopalakr- ishnan, Karol Hausman, Brian Ichter, Alex Irpan, Nikhil Joshi, Ryan Julian, et al. Autort: Embodied foundation models for large scale orchestration of robotic agents.arXiv preprint arXiv:...

    2024

  4. [13]

    Ai control: Improving safety despite intentional subversion.arXiv preprint arXiv:2312.06942, 2023

    Ryan Greenblatt, Buck Shlegeris, Kshitij Sachan, and Fabien Roger. Ai control: Improving safety despite intentional subversion.arXiv preprint arXiv:2312.06942, 2023. 1

    2023 arXiv

  5. [14]

    Alignment faking in large language models.arXiv preprint arXiv:2412.14093, 2024

    Ryan Greenblatt, Carson Denison, Benjamin Wright, Fabien Roger, Monte MacDiarmid, Sam Marks, Johannes Treutlein, Tim Belonax, Jack Chen, David Duvenaud, et al. Alignment faking in large language models.arXiv preprint arXiv:2412.14093, 2024

    2024 arXiv

  6. [15]

    Adversaries can misuse combinations of safe models.arXiv preprint arXiv:2406.14595, 2024

    Erik Jones, Anca Dragan, and Jacob Steinhardt. Adversaries can misuse combinations of safe models.arXiv preprint arXiv:2406.14595, 2024. 1 10

    2024 arXiv

  7. [16]

    Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents

    Edoardo Debenedetti, Jie Zhang, Mislav Balunovic, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents. InThe Thirty-eight Conference on Neural Information Processing Systems Da...

    2024

  8. [17]

    Prompt injection attack against llm-integrated applications.arXiv preprint arXiv:2306.05499, 2023

    Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Zihao Wang, Xiaofeng Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, et al. Prompt injection attack against llm-integrated applications.arXiv preprint arXiv:2306.05499, 2023

    2023 arXiv

  9. [18]

    Defeating prompt injections by design.arXiv preprint arXiv:2503.18813, 2025

    Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, and Florian Tramèr. Defeating prompt injections by design.arXiv preprint arXiv:2503.18813, 2025. 1

    2025 arXiv

  10. [19]

    Pappas, and Eric Wong

    Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. Jailbreaking black box large language models in twenty queries, 2024. URL https://arxiv.org/abs/2310.08419. 1, 3, 6

    2024 arXiv

  11. [20]

    Zico Kolter, and Matt Fredrikson

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models, 2023. URL https: //arxiv.org/abs/2307.15043. 3, 4, 5, 7

    2023 arXiv

  12. [21]

    Jailbreakbench: An open robustness benchmark for jailbreaking large language models

    Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J Pappas, Florian Tramer, et al. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. arXiv pre...

    2024 arXiv

  13. [22]

    Is power-seeking ai an existential risk?arXiv preprint arXiv:2206.13353,

    Joseph Carlsmith. Is power-seeking ai an existential risk?arXiv preprint arXiv:2206.13353,

    arXiv

  14. [23]

    Risks from learned optimization in advanced machine learning systems.arXiv preprint arXiv:1906.01820, 2019

    Evan Hubinger, Chris van Merwijk, Vladimir Mikulik, Joar Skalse, and Scott Garrabrant. Risks from learned optimization in advanced machine learning systems.arXiv preprint arXiv:1906.01820, 2019

    1906 arXiv

  15. [24]

    Deceptive alignment monitoring.arXiv preprint arXiv:2307.10569, 2023

    Andres Carranza, Dhruv Pai, Rylan Schaeffer, Arnuv Tandon, and Sanmi Koyejo. Deceptive alignment monitoring.arXiv preprint arXiv:2307.10569, 2023. 1

    2023 arXiv

  16. [25]

    Replibench: Evaluating the autonomous replication capabilities of language model agents.arXiv preprint arXiv:2504.18565,

    Sid Black, Asa Cooper Stickland, Jake Pencharz, Oliver Sourbut, Michael Schmatz, Jay Bailey, Ollie Matthews, Ben Millwood, Alex Remedios, and Alan Cooney. Replibench: Evaluating the autonomous replication capabilities of language model agents.arXiv preprint arXiv:2504.18565,

    arXiv

  17. [26]

    Frontier ai systems have surpassed the self-replicating red line.arXiv preprint arXiv:2412.12140, 2024

    Xudong Pan, Jiarun Dai, Yihe Fan, and Min Yang. Frontier ai systems have surpassed the self-replicating red line.arXiv preprint arXiv:2412.12140, 2024. 1

    2024 arXiv

  18. [27]

    Openvla: An open-source vision-language-action model.arXiv preprint arXiv:2406.09246,

    Moo Jin Kim, Karl Pertsch, Siddharth Karamcheti, Ted Xiao, Ashwin Balakrishna, Suraj Nair, Rafael Rafailov, Ethan Foster, Grace Lam, Pannag Sanketi, Quan Vuong, Thomas Kollar, Benjamin Burchfiel, Russ Tedrake, Dorsa Sadigh, Sergey Levine, Percy Liang, and Chelsea Finn. Openvla...

    arXiv

  19. [29]

    Jailbreaking llm-controlled robots.arXiv preprint arXiv:2410.13691, 2024

    Alexander Robey, Zachary Ravichandran, Vijay Kumar, Hamed Hassani, and George J Pappas. Jailbreaking llm-controlled robots.arXiv preprint arXiv:2410.13691, 2024. 2, 3

    2024 arXiv

  20. [30]

    Badrobot: Manipulating embodied llms in the physical world.arXiv preprint arXiv:2407.20242, 2024

    Hangtao Zhang, Chenyu Zhu, Xianlong Wang, Ziqi Zhou, Changgan Yin, Minghui Li, Lulu Xue, Yichen Wang, Shengshan Hu, Aishan Liu, et al. Badrobot: Manipulating embodied llms in the physical world.arXiv preprint arXiv:2407.20242, 2024. 2, 3 11

    2024 arXiv

  21. [31]

    Deep reinforcement learning for robotic manipulation with asynchronous off-policy updates

    Shixiang Gu, Ethan Holly, Timothy Lillicrap, and Sergey Levine. Deep reinforcement learning for robotic manipulation with asynchronous off-policy updates. In2017 IEEE International Conference on Robotics and Automation (ICRA), pages 3389–3396, 2017. doi: 10.1109/ICRA. 2017.7989385. 2

    2017

  22. [32]

    End-to-end training of deep visuomotor policies, 2016

    Sergey Levine, Chelsea Finn, Trevor Darrell, and Pieter Abbeel. End-to-end training of deep visuomotor policies, 2016. URLhttps://arxiv.org/abs/1504.00702. 2

    2016 arXiv

  23. [33]

    R3m: A universal visual representation for robot manipulation, 2022

    Suraj Nair, Aravind Rajeswaran, Vikash Kumar, Chelsea Finn, and Abhinav Gupta. R3m: A universal visual representation for robot manipulation, 2022. URL https://arxiv.org/abs/ 2203.12601. 2

    2022 arXiv

  24. [34]

    Attention is all you need.Advances in Neural Information Processing Systems, 30, 2017

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need.Advances in Neural Information Processing Systems, 30, 2017. 2

    2017

  25. [35]

    Chatgpt for robotics: Design principles and model abilities, 2023

    Sai Vemprala, Rogerio Bonatti, Arthur Bucker, and Ashish Kapoor. Chatgpt for robotics: Design principles and model abilities, 2023. URLhttps://arxiv.org/abs/2306.17582. 3

    2023 arXiv

  26. [36]

    Code as policies: Language model programs for embodied control

    Jacky Liang, Wenlong Huang, Fei Xia, Peng Xu, Karol Hausman, Brian Ichter, Pete Florence, and Andy Zeng. Code as policies: Language model programs for embodied control. In2023 IEEE International Conference on Robotics and Automation (ICRA), pages 9493–9500. IEEE,

  27. [37]

    How to prompt your robot: A promptbook for manipulation skills with code as policies

    Montserrat Gonzalez Arenas, Ted Xiao, Sumeet Singh, Vidhi Jain, Allen Ren, Quan Vuong, Jake Varley, Alexander Herzog, Isabel Leal, Sean Kirmani, et al. How to prompt your robot: A promptbook for manipulation skills with code as policies. In2024 IEEE International Conference on...

    2024

  28. [38]

    Chatgpt for robotics: Design principles and model abilities.IEEE Access, 2024

    Sai H Vemprala, Rogerio Bonatti, Arthur Bucker, and Ashish Kapoor. Chatgpt for robotics: Design principles and model abilities.IEEE Access, 2024. 3

    2024

  29. [39]

    Driving everywhere with large language model policy adaptation, 2024

    Boyi Li, Yue Wang, Jiageng Mao, Boris Ivanovic, Sushant Veer, Karen Leung, and Marco Pavone. Driving everywhere with large language model policy adaptation, 2024. URL https: //arxiv.org/abs/2402.05932. 3

    2024 arXiv

  30. [40]

    A survey on multimodal large language models for autonomous driving, 2023

    Can Cui, Yunsheng Ma, Xu Cao, Wenqian Ye, Yang Zhou, Kaizhao Liang, Jintai Chen, Juanwu Lu, Zichong Yang, Kuei-Da Liao, Tianren Gao, Erlong Li, Kun Tang, Zhipeng Cao, Tong Zhou, Ao Liu, Xinrui Yan, Shuqi Mei, Jianguo Cao, Ziran Wang, and Chao Zheng. A survey on multimodal larg...

    2023 arXiv

  31. [41]

    Deploying and evaluating llms to program service mobile robots.IEEE Robotics and Automation Letters, 9(3):2853–2860, March 2024

    Zichao Hu, Francesca Lucchetti, Claire Schlesinger, Yash Saxena, Anders Freeman, Sadanand Modak, Arjun Guha, and Joydeep Biswas. Deploying and evaluating llms to program service mobile robots.IEEE Robotics and Automation Letters, 9(3):2853–2860, March 2024. ISSN 2377-3774. doi...

    2024

  32. [42]

    SayPlan: Grounding Large Language Models using 3D Scene Graphs for Scalable Task Planning

    Krishan Rana, Jesse Haviland, Sourav Garg, Jad Abou-Chakra, Ian Reid, and Niko Suenderhauf. SayPlan: Grounding Large Language Models using 3D Scene Graphs for Scalable Task Planning. In7th Annual Conference on Robot Learning, 2023. URL https://openreview.net/ forum?id=wMpOMO0Ss7a. 3

    2023

  33. [43]

    Palm: Scaling language modeling with pathways.Journal of Machine Learning Research, 24(240): 1–113, 2023

    Aakanksha Chowdhery, Sharan Narang, Jacob Devlin, Maarten Bosma, Gaurav Mishra, Adam Roberts, Paul Barham, Hyung Won Chung, Charles Sutton, Sebastian Gehrmann, et al. Palm: Scaling language modeling with pathways.Journal of Machine Learning Research, 24(240): 1–113, 2023. 3

    2023

  34. [44]

    Mostafa Dehghani, Josip Djolonga, Basil Mustafa, Piotr Padlewski, Jonathan Heek, Justin Gilmer, Andreas Steiner, Mathilde Caron, Robert Geirhos, Ibrahim Alabdulmohsin, Rodolphe Je- natton, Lucas Beyer, Michael Tschannen, Anurag Arnab, Xiao Wang, Carlos Riquelme, Matthias Minde...

    2023 arXiv

  35. [45]

    Danny Driess, Fei Xia, Mehdi S. M. Sajjadi, Corey Lynch, Aakanksha Chowdhery, Brian Ichter, Ayzaan Wahid, Jonathan Tompson, Quan Vuong, Tianhe Yu, Wenlong Huang, Yevgen Chebotar, Pierre Sermanet, Daniel Duckworth, Sergey Levine, Vincent Vanhoucke, Karol Hausman, Marc Toussaint...

    2023 arXiv

  36. [46]

    Sayplan: Grounding large language models using 3d scene graphs for scalable robot task planning, 2023

    Krishan Rana, Jesse Haviland, Sourav Garg, Jad Abou-Chakra, Ian Reid, and Niko Suenderhauf. Sayplan: Grounding large language models using 3d scene graphs for scalable robot task planning, 2023. URLhttps://arxiv.org/abs/2307.06135. 3

    2023 arXiv

  37. [47]

    Tenenbaum, Antonio Torralba, Florian Shkurti, and Liam Paull

    Qiao Gu, Alihusein Kuwajerwala, Sacha Morin, Krishna Murthy Jatavallabhula, Bipasha Sen, Aditya Agarwal, Corban Rivera, William Paul, Kirsty Ellis, Rama Chellappa, Chuang Gan, Celso Miguel de Melo, Joshua B. Tenenbaum, Antonio Torralba, Florian Shkurti, and Liam Paull. Concept...

  38. [48]

    An embodied generalist agent in 3d world,

    Jiangyong Huang, Silong Yong, Xiaojian Ma, Xiongkun Linghu, Puhao Li, Yan Wang, Qing Li, Song-Chun Zhu, Baoxiong Jia, and Siyuan Huang. An embodied generalist agent in 3d world,

  39. [49]

    Do as i can and not as i say: Grounding language in robotic affordances

    Michael Ahn, Anthony Brohan, Noah Brown, Yevgen Chebotar, Omar Cortes, Byron David, Chelsea Finn, Chuyuan Fu, Keerthana Gopalakrishnan, Karol Hausman, Alex Herzog, Daniel Ho, Jasmine Hsu, Julian Ibarz, Brian Ichter, Alex Irpan, Eric Jang, Rosario Jauregui Ruano, Kyle Jeffrey, ...

    2022 arXiv

  40. [50]

    Octo: An open-source generalist robot policy

    Octo Model Team, Dibya Ghosh, Homer Walke, Karl Pertsch, Kevin Black, Oier Mees, Sudeep Dasari, Joey Hejna, Charles Xu, Jianlan Luo, Tobias Kreiman, You Liang Tan, Lawrence Yun- liang Chen, Pannag Sanketi, Quan Vuong, Ted Xiao, Dorsa Sadigh, Chelsea Finn, and Sergey Levine. Oc...

    2024

  41. [51]

    Rt-2: Vision-language-action models transfer web knowledge to robotic control, 2023

    Anthony Brohan, Noah Brown, Justice Carbajal, Yevgen Chebotar, Xi Chen, Krzysztof Choro- manski, Tianli Ding, Danny Driess, Avinava Dubey, Chelsea Finn, Pete Florence, Chuyuan Fu, Montse Gonzalez Arenas, Keerthana Gopalakrishnan, Kehang Han, Karol Hausman, Alexander Herzog, Ja...

    2023 arXiv

  42. [52]

    Open X-Embodiment Collaboration, Abby O’Neill, Abdul Rehman, Abhinav Gupta, Abhi- ram Maddukuri, Abhishek Gupta, Abhishek Padalkar, Abraham Lee, Acorn Pooley, Agrim Gupta, Ajay Mandlekar, Ajinkya Jain, Albert Tung, Alex Bewley, Alex Herzog, Alex Irpan, Alexander Khazatsky, Ana...

    arXiv

  43. [53]

    Outrageously large neural networks: The sparsely-gated mixture-of-experts layer.arXiv preprint arXiv:1701.06538, 2017

    Noam Shazeer, Azalia Mirhoseini, Krzysztof Maziarz, Andy Davis, Quoc Le, Geoffrey Hinton, and Jeff Dean. Outrageously large neural networks: The sparsely-gated mixture-of-experts layer.arXiv preprint arXiv:1701.06538, 2017. 3

    2017 arXiv

  44. [54]

    Cogact: A foundational vision-language- action model for synergizing cognition and action in robotic manipulation, 2024

    Qixiu Li, Yaobo Liang, Zeyu Wang, Lin Luo, Xi Chen, Mozheng Liao, Fangyun Wei, Yu Deng, Sicheng Xu, Yizhong Zhang, Xiaofan Wang, Bei Liu, Jianlong Fu, Jianmin Bao, Dong Chen, Yuanchun Shi, Jiaolong Yang, and Baining Guo. Cogact: A foundational vision-language- action model for...

    2024 arXiv

  45. [55]

    A general language assistant as a laboratory for alignment.arXiv preprint arXiv:2112.00861, 2021

    Amanda Askell, Yuntao Bai, Anna Chen, Dawn Drain, Deep Ganguli, Tom Henighan, Andy Jones, Nicholas Joseph, Ben Mann, Nova DasSarma, et al. A general language assistant as a laboratory for alignment.arXiv preprint arXiv:2112.00861, 2021. 3

    2021 arXiv

  46. [56]

    Regulating chatgpt and other large generative ai models

    Philipp Hacker, Andreas Engel, and Marco Mauer. Regulating chatgpt and other large generative ai models. InProceedings of the 2023 ACM Conference on Fairness, Accountability, and Transparency, pages 1112–1123, 2023. 14

    2023

  47. [57]

    Training language models to follow instructions with human feedback.Advances in neural information processing systems, 35:27730–27744, 2022

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback.Advances in neural information processing systems, 35:27730...

    2022

  48. [58]

    Jailbroken: How does llm safety training fail?Advances in Neural Information Processing Systems, 36, 2024

    Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does llm safety training fail?Advances in Neural Information Processing Systems, 36, 2024. 3

    2024

  49. [59]

    Are aligned neural networks adversarially aligned?Advances in Neural Information Processing Systems, 36, 2024

    Nicholas Carlini, Milad Nasr, Christopher A Choquette-Choo, Matthew Jagielski, Irena Gao, Pang Wei W Koh, Daphne Ippolito, Florian Tramer, and Ludwig Schmidt. Are aligned neural networks adversarially aligned?Advances in Neural Information Processing Systems, 36, 2024. 3

    2024

  50. [60]

    Agentharm: A benchmark for measuring harmfulness of llm agents, 2024

    Maksym Andriushchenko, Alexandra Souly, Mateusz Dziemian, Derek Duenas, Maxwell Lin, Justin Wang, Dan Hendrycks, Andy Zou, Zico Kolter, Matt Fredrikson, Eric Winsor, Jerome Wynne, Yarin Gal, and Xander Davies. Agentharm: A benchmark for measuring harmfulness of llm agents, 202...

    2024 arXiv

  51. [61]

    Frontier models are capable of in-context scheming.arXiv preprint arXiv:2412.04984, 2024

    Alexander Meinke, Bronson Schoen, Jérémy Scheurer, Mikita Balesni, Rusheb Shah, and Marius Hobbhahn. Frontier models are capable of in-context scheming.arXiv preprint arXiv:2412.04984, 2024

    2024 arXiv

  52. [62]

    Stress-testing capability elicitation with password-locked models.arXiv preprint arXiv:2405.19550, 2024

    Ryan Greenblatt, Fabien Roger, Dmitrii Krasheninnikov, and David Krueger. Stress-testing capability elicitation with password-locked models.arXiv preprint arXiv:2405.19550, 2024. 3

    2024 arXiv

  53. [63]

    A safe harbor for ai evaluation and red teaming.arXiv preprint arXiv:2403.04893, 2024

    Shayne Longpre, Sayash Kapoor, Kevin Klyman, Ashwin Ramaswami, Rishi Bommasani, Borhane Blili-Hamelin, Yangsibo Huang, Aviya Skowron, Zheng-Xin Yong, Suhas Kotha, et al. A safe harbor for ai evaluation and red teaming.arXiv preprint arXiv:2403.04893, 2024. 3

    2024 arXiv

  54. [64]

    Open problems in technical ai governance.arXiv preprint arXiv:2407.14981, 2024

    Anka Reuel, Ben Bucknall, Stephen Casper, Tim Fist, Lisa Soder, Onni Aarne, Lewis Hammond, Lujain Ibrahim, Alan Chan, Peter Wills, et al. Open problems in technical ai governance.arXiv preprint arXiv:2407.14981, 2024. 3

    2024 arXiv

  55. [65]

    Autodan: Generating stealthy jailbreak prompts on aligned large language models.arXiv preprint arXiv:2310.04451, 2023

    Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. Autodan: Generating stealthy jailbreak prompts on aligned large language models.arXiv preprint arXiv:2310.04451, 2023. 3

    2023 arXiv

  56. [66]

    Visual adversarial examples jailbreak aligned large language models

    Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. Visual adversarial examples jailbreak aligned large language models. InProceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 21527–21536, 2024. 3

    2024

  57. [67]

    Llm defenses are not robust to multi-turn human jailbreaks yet.arXiv preprint arXiv:2408.15221, 2024

    Nathaniel Li, Ziwen Han, Ian Steneker, Willow Primack, Riley Goodside, Hugh Zhang, Zifan Wang, Cristina Menghini, and Summer Yue. Llm defenses are not robust to multi-turn human jailbreaks yet.arXiv preprint arXiv:2408.15221, 2024. 3

    2024 arXiv

  58. [68]

    Great, now write an article about that: The crescendo multi-turn llm jailbreak attack.arXiv preprint arXiv:2404.01833, 2024

    Mark Russinovich, Ahmed Salem, and Ronen Eldan. Great, now write an article about that: The crescendo multi-turn llm jailbreak attack.arXiv preprint arXiv:2404.01833, 2024. 3

    2024 arXiv

  59. [69]

    Improving alignment and robustness with circuit breakers

    Andy Zou, Long Phan, Justin Wang, Derek Duenas, Maxwell Lin, Maksym Andriushchenko, J Zico Kolter, Matt Fredrikson, and Dan Hendrycks. Improving alignment and robustness with circuit breakers. InThe Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. 3, 6

    2024

  60. [70]

    Smoothllm: Defending large language models against jailbreaking attacks.arXiv preprint arXiv:2310.03684, 2023

    Alexander Robey, Eric Wong, Hamed Hassani, and George J Pappas. Smoothllm: Defending large language models against jailbreaking attacks.arXiv preprint arXiv:2310.03684, 2023. 3, 9

    2023 arXiv

  61. [71]

    Openai o1 system card.arXiv preprint arXiv:2412.16720, 2024

    Aaron Jaech, Adam Kalai, Adam Lerer, Adam Richardson, Ahmed El-Kishky, Aiden Low, Alec Helyar, Aleksander Madry, Alex Beutel, Alex Carney, et al. Openai o1 system card.arXiv preprint arXiv:2412.16720, 2024. 3

    2024 arXiv

  62. [72]

    The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024. 3 15

    2024 arXiv

  63. [73]

    Adversarial attacks on multimodal agents.arXiv preprint arXiv:2406.12814, 2024

    Chen Henry Wu, Jing Yu Koh, Ruslan Salakhutdinov, Daniel Fried, and Aditi Raghunathan. Adversarial attacks on multimodal agents.arXiv preprint arXiv:2406.12814, 2024. 3

    2024 arXiv

  64. [74]

    Badagent: Inserting and activating backdoor attacks in llm agents.arXiv preprint arXiv:2406.03007, 2024

    Yifei Wang, Dizhan Xue, Shengjie Zhang, and Shengsheng Qian. Badagent: Inserting and activating backdoor attacks in llm agents.arXiv preprint arXiv:2406.03007, 2024. 3

    2024 arXiv

  65. [75]

    Adversarial search engine optimiza- tion for large language models.arXiv preprint arXiv:2406.18382, 2024

    Fredrik Nestaas, Edoardo Debenedetti, and Florian Tramèr. Adversarial search engine optimiza- tion for large language models.arXiv preprint arXiv:2406.18382, 2024. 3

    2024 arXiv

  66. [76]

    Embodied red teaming for auditing robotic foundation models, 2024

    Sathwik Karnik, Zhang-Wei Hong, Nishant Abhangi, Yen-Chen Lin, Tsun-Hsuan Wang, and Pulkit Agrawal. Embodied red teaming for auditing robotic foundation models, 2024. URL https://arxiv.org/abs/2411.18676. 3

    2024 arXiv

  67. [77]

    Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199, 2013

    C Szegedy. Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199, 2013. 6

    2013 arXiv

  68. [78]

    Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017

    Aleksander Madry. Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017. 6

    2017 arXiv

  69. [79]

    Scalable and transferable black-box jailbreaks for language models via persona modulation.arXiv preprint arXiv:2311.03348, 2023

    Rusheb Shah, Soroush Pour, Arush Tagade, Stephen Casper, Javier Rando, et al. Scalable and transferable black-box jailbreaks for language models via persona modulation.arXiv preprint arXiv:2311.03348, 2023. 6

    2023 arXiv

  70. [80]

    Hydra: Hybrid robot actions for imitation learning, 2023

    Suneel Belkhale, Yuchen Cui, and Dorsa Sadigh. Hydra: Hybrid robot actions for imitation learning, 2023. URLhttps://arxiv.org/abs/2306.17237. 8

    2023 arXiv

  71. [81]

    Evaluating real-world robot manipulation policies in simulation

    Xuanlin Li, Kyle Hsu, Jiayuan Gu, Karl Pertsch, Oier Mees, Homer Rich Walke, Chuyuan Fu, Ishikaa Lunawat, Isabel Sieh, Sean Kirmani, Sergey Levine, Jiajun Wu, Chelsea Finn, Hao Su, Quan Vuong, and Ted Xiao. Evaluating real-world robot manipulation policies in simulation. arXiv...

    2024 arXiv

  72. [82]

    Tracevla: Visual trace prompting enhances spatial-temporal awareness for generalist robotic policies, 2024

    Ruijie Zheng, Yongyuan Liang, Shuaiyi Huang, Jianfeng Gao, Hal Daumé III, Andrey Kolobov, Furong Huang, and Jianwei Yang. Tracevla: Visual trace prompting enhances spatial-temporal awareness for generalist robotic policies, 2024. URLhttps://arxiv.org/abs/2412.10345. 8, 19

    2024 arXiv

  73. [83]

    GitHub - allenzren/open-pi-zero: Re-implementation of pi0 vision-language-action (VLA) model from Physical Intelligence — github.com

    Allen Ren. GitHub - allenzren/open-pi-zero: Re-implementation of pi0 vision-language-action (VLA) model from Physical Intelligence — github.com. https://github.com/allenzren/ open-pi-zero, 2024. [Accessed 29-01-2025]. 8, 19

    2024

  74. [84]

    Failures to find transferable image jailbreaks between vision-language models

    Rylan Schaeffer, Dan Valentine, Luke Bailey, James Chua, Cristobal Eyzaguirre, Zane Durante, Joe Benton, Brando Miranda, Henry Sleight, Tony Tong Wang, et al. Failures to find transferable image jailbreaks between vision-language models. InThe Thirteenth International Conferen...

    2024

  75. [85]

    Jailbreak and guard aligned language models with only few in-context demonstrations.arXiv preprint arXiv:2310.06387,

    Zeming Wei, Yifei Wang, Ang Li, Yichuan Mo, and Yisen Wang. Jailbreak and guard aligned language models with only few in-context demonstrations.arXiv preprint arXiv:2310.06387,

    arXiv

  76. [86]

    Baseline de- fenses for adversarial attacks against aligned language models.arXiv preprint arXiv:2309.00614,

    Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. Baseline de- fenses for adversarial attacks against aligned language models.arXiv preprint arXiv:2309.00614,

    arXiv

  77. [87]

    Training a helpful and harmless assistant with reinforcement learning from human feedback, 2022

    Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, Nicholas Joseph, Saurav Kadavath, Jackson Kernion, Tom Conerly, Sheer El-Showk, Nelson Elhage, Zac Hatfield-Dodds, Danny Hernandez, Tristan H...

    2022 arXiv

  78. [88]

    Brown, Miljan Martic, Shane Legg, and Dario Amodei

    Paul Christiano, Jan Leike, Tom B. Brown, Miljan Martic, Shane Legg, and Dario Amodei. Deep reinforcement learning from human preferences, 2023. URL https://arxiv.org/abs/ 1706.03741. 9 16

    2023 arXiv

  79. [89]

    Scalable agent alignment via reward modeling: a research direction, 2018

    Jan Leike, David Krueger, Tom Everitt, Miljan Martic, Vishal Maini, and Shane Legg. Scalable agent alignment via reward modeling: a research direction, 2018. URL https://arxiv.org/ abs/1811.07871. 9

    2018 arXiv

  80. [90]

    Harmbench: A standardized evaluation framework for automated red teaming and robust refusal, 2024

    Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal, 2024. URL https://arxiv.org...

    2024 arXiv

  81. [91]

    Grape: Generalizing robot policy via preference alignment.arXiv preprint arXiv:2411.19309, 2024

    Zijian Zhang, Kaiyuan Zheng, Zhaorun Chen, Joel Jang, Yi Li, Chaoqi Wang, Mingyu Ding, Dieter Fox, and Huaxiu Yao. Grape: Generalizing robot policy via preference alignment.arXiv preprint arXiv:2411.19309, 2024. 9

    2024 arXiv

  82. [92]

    Abbas, Shakra Mehak, Georgios C

    Ammar N. Abbas, Shakra Mehak, Georgios C. Chasparis, John D. Kelleher, Michael Guilfoyle, Maria Chiara Leva, and Aswin K Ramasubramanian. Safety-driven deep reinforcement learning framework for cobots: A sim2real approach, 2024. URL https://arxiv.org/abs/2407. 02231. 9

    2024

  83. [93]

    Safevla: Towards safety alignment of vision-language-action model via safe reinforcement learning.arXiv preprint arXiv:2503.03480, 2025

    Borong Zhang, Yuhao Zhang, Jiaming Ji, Yingshan Lei, Josef Dai, Yuanpei Chen, and Yaodong Yang. Safevla: Towards safety alignment of vision-language-action model via safe reinforcement learning.arXiv preprint arXiv:2503.03480, 2025. 9

    2025 arXiv

  84. [94]

    Safety guardrails for llm-enabled robots.arXiv preprint arXiv:2503.07885, 2025

    Zachary Ravichandran, Alexander Robey, Vijay Kumar, George J Pappas, and Hamed Hassani. Safety guardrails for llm-enabled robots.arXiv preprint arXiv:2503.07885, 2025. 9

    2025

  85. [95]

    pick coke can

    Kyle Stachowicz, Lydia Ignatova, and Sergey Levine. Lifelong autonomous improvement of navigation foundation models in the wild. In8th Annual Conference on Robot Learning, 2024. 18 17 A On the consequences of fine-tuning 0 1 2 3 4 5 6 Action index 0 20 40 60Percent change Goal...

    2024

  86. [2023]

    Accessed: 2025-01-06. 1

    2025

  87. [2024]

    URLhttps://arxiv.org/abs/2311.12871. 3

    arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.