VLA & Robot Security · Working paper preview
StaleAction
Physical TOCTOU attacks against Vision-Language-Action robots, with proposed measures for Observation–Action Age and the Adversarial Freshness Window.
Preview the conceptResearch program
Our current priority is the security of vision-language models, Vision-Language-Action systems, and robots: intelligent systems whose perceptions can become physical decisions and actions.
Guiding question: What breaks when intelligence stops being a stateless model and becomes a persistent actor in a shared world?
Current focus: vision, action, and robotics
Perception
Vision-Language Model Security
We study adversarial visual inputs, physical prompt injection, scene manipulation, multimodal grounding failures, and trust boundaries between cameras, language instructions, and system state.
Physical action
VLA & Robot Security
We study action chunking, stale observations, physical TOCTOU, runtime revalidation, robotic control interfaces, and attacks that cross from model decisions into physical outcomes.
StaleAction is the first bridge project in this direction. It asks whether a robot can observe a legitimate scene, commit to an action, and then act incorrectly because the relevant physical state changed after observation.
Research areas
01 / Perception
VLM Security
Multimodal attacks, physical prompt injection, scene manipulation, grounding, and adversarial perception.
02 / Physical action
VLA & Robot Security
Action freshness, physical TOCTOU, runtime validation, robotics, and perception-to-action failures.
03 / Autonomous systems
Agent & Multi-Agent Security
Tool use, authority boundaries, coordination, shared state, adversarial propagation, and emergent behavior.
04 / Persistent state
Memory & Provenance
Retrieval, poisoning, lineage, correlated evidence, persistence, and cross-agent propagation.
A continuous security model
Memory failures and embodied failures share a central structure: a system acts on a representation of reality that may no longer be trustworthy. A stored representation can be stale, poisoned, duplicated, or incorrectly sourced. A physical representation can become stale between perception and action.
These layers can combine in persistent embodied agents and robot fleets: physical observation → local memory → shared memory → other agents → physical actions. We aim to study the complete chain.
Research philosophy
Empirical
Claims should be supported by measurable experiments whenever possible.
Reproducible
Experiments, harnesses, configurations, metrics, and relevant code should be published whenever practical.
Adversarial
We study systems under intentional manipulation, unexpected environments, correlated failures, and hostile inputs.
Systems-oriented
Our unit of study is the complete system and its interaction boundaries, beyond isolated model benchmarks.
Open and evidence-aware
We make work public when responsible disclosure and safety permit, and label hypotheses, observations, findings, negative results, and speculation clearly.
Active programs
Agent systems · Active infrastructure
Persistent state & agent populations
Public memory, provenance-aware experiments, collective behavior, and security failures that appear across agents and runs.
Explore the Agent Systems Lab