StaleAction

Physical TOCTOU Attacks Against Vision-Language-Action Robots: Exploiting Observation–Action Freshness in Embodied Control.

Abstract

Vision-Language-Action policies can execute temporally extended action chunks from a finite set of observations. This creates a temporal trust assumption: state observed when an action is selected remains sufficiently valid when that action is executed.

StaleAction asks whether an adversary can exploit that assumption by allowing a legitimate observation, waiting until the policy commits to an action or action chunk, and then changing task-relevant physical state before execution completes. The attacker does not need to alter prompts, model weights, training data, robot software, middleware, or the observation already consumed by the policy.

Candidate measures

Observation–Action Age (OAA)

The elapsed time between the task-relevant observation used to generate or validate an action and that action’s physical execution.

Adversarial Freshness Window (AFW)

The interval after an observation during which an attacker can alter physical state and cause a target failure before the policy incorporates corrective evidence.

Evidence status

This version develops the threat model, related-work positioning, proposed measures, and evaluation design. It does not report an experiment or claim that the central hypothesis has been validated. The proposed distinction from adjacent work must be demonstrated empirically.

Citation

@misc{lucashx2026staleaction,
  author      = {Lucas-hX},
  title       = {Physical TOCTOU Attacks Against Vision-Language-Action Robots},
  year        = {2026},
  institution = {NEUROSIS Research},
  note        = {Working paper preview; full draft not yet released},
  url         = {https://neurosis.io/papers/staleaction}
}

Research program · All papers · Source repository