Vision-Language-Action Safety: Threats, Challenges, Evaluations, and Mechanisms

Figure 1 : Development timeline of representative VLA capability models (top lane) and representative VLA safety research (bottom lane), 2022 to 2026. The rapid proliferation of powerful open-source VLA models has increasingly shifted research attention toward safety, motivating a growing body of work on vulnerabilities and risk mitigation.

Figure 3 : General architecture of Vision-Language-Action models. A visual encoder (e.g., CLIP [ radford2021learning ] , SigLIP [ zhai2023sigmoid ] ) extracts visual token embeddings from camera observations; a large language model backbone (e.g., LLaMA [ grattafiori2024llama ] ) integrates visual features with the natural language task description and proprioceptive state; an action decoder generates robot control commands via token prediction, continuous regression, or flow matching.

Figure 6 : Taxonomy of inference-time safety and robustness in VLA models. The diagram categorizes the research landscape into three areas: Inference-Time Attacks (left), Inference-Time Defenses (right), and Evaluation & Benchmarks (bottom). The outer margin lists representative frameworks and their corresponding institutions for each sub-domain.

Figure 7 : The decoupled inference-time defense architecture for Vision-Language-Action (VLA) models. To resolve the safety-latency paradox, the framework operates a dual-loop mechanism around the main pipeline. The reasoning-heavy "Slow Reasoning" loop (right, \sim 1Hz) utilizes Vision-Language Models (VLMs) to monitor execution and Large Language Models (LLMs) to translate Natural Language (NL) intent into strict formal logic, such as Signal Temporal Logic (STL). These logical constraints dynamically define the safety bounds ( \Omega_{safe} ) enforced by the semantically blind "Fast Reflexes

Figure 2 : An overview of the VLA safety landscape covered in this survey. We organize threats along two primary dimensions: attack timing (training-time vs. inference-time) and defense timing (training-time vs. inference-time), and survey corresponding defense mechanisms, evaluation benchmarks and metrics.

Figure 5 : Comparison of attack success rates (ASR) of representative training-time attacks on OpenVLA and \pi 0 across four LIBERO benchmarks.

Figure 9 : The simulation-to-reality gap in VLA safety evaluation. Safety guarantees established through simulation benchmarks (left) must transfer across multiple gap factors before they can be relied upon in real-world deployment (right). Current benchmarks predominantly operate in simulation, leaving the transferability of safety assurances as a fundamental open challenge.

Figure 10 : Number of arXiv publications retrieved via keyword-based search (titles and abstracts) for VLA-related papers and VLA safety-related papers. The results show a rapid increase in both general VLA research and safety-focused VLA studies, with safety-related work growing particularly sharply after 2024.