PaperlayerView exact revision on arXiv

Source-linked AI summary

Vision-Language-Action Safety: Threats, Challenges, Evaluations, and Mechanisms

Qi Li, Bo Yin, Weiqi Huang, Ruhao Liu, Bojun Zou, Runpeng Yu, Jingwen Ye, Weihao Yu, Xinchao Wang

arXiv:2604.23775v1cs.RO

TL;DR

VLA safety research is fragmented despite growing deployment in consequential physical domains. This survey unifies threats, defenses, evaluations, and deployment challenges along attack- and defense-timing axes, finding that evaluation is maturing unevenly, with heterogeneous metrics and limited physical validation.

  • Problem

    VLA deployment across consequential physical domains creates an urgent need to address safety limitations, while existing research remains fragmented across disciplines.

  • Method

    The survey synthesizes VLA safety literature through attack and defense timing axes, covering threats, mechanisms, evaluations, and deployment domains.

  • Results

    Evaluation is maturing unevenly: benchmarks cover training- and inference-time threats, but metrics remain heterogeneous, adversarial splits uneven, and simulation dominates physical validation.

  • Takeaways & Limitations

    The survey highlights physically realizable defenses and standardized evaluation as priorities for advancing VLA safety research.

  • Takeaways & Limitations

    Collision rate alone is insufficient because it treats collisions equally regardless of severity.

Abstract

from arXiv · show

Vision-Language-Action (VLA) models are emerging as a unified substrate for embodied intelligence. This shift raises a new class of safety challenges, stemming from the embodied nature of VLA systems, including irreversible physical consequences, a multimodal attack surface across vision, language, and state, real-time latency constraints on defense, error propagation over long-horizon trajectories, and vulnerabilities in the data supply chain. Yet the literature remains fragmented across robotic learning, adversarial machine learning, AI alignment, and autonomous systems safety. This survey provides a unified and up-to-date overview of safety in Vision-Language-Action models. We organize the field along two parallel timing axes, attack timing (training-time vs. inference-time and defense timing (training-time vs. inference-time, linking each class of threat to the stage at which it can be mitigated. We first define the scope of VLA safety, distinguishing it from text-only LLM safety and classical robotic safety, and review the foundations of VLA models, including architectures, training paradigms, and inference mechanisms. We then examine the literature through four lenses: Attacks, Defenses, Evaluation, and Deployment. We survey training-time threats such as data poisoning and backdoors, as well as inference-time attacks including adversarial patches, cross-modal perturbations, semantic jailbreaks, and freezing attacks. We review training-time and runtime defenses, analyze existing benchmarks and metrics, and discuss safety challenges across six deployment domains. Finally, we highlight key open problems, including certified robustness for embodied trajectories, physically realizable defenses, safety-aware training, unified runtime safety architectures, and standardized evaluation.

1 Introduction

VLA models unify visual perception, language understanding, and physical action generation, enabling broad deployment while introducing safety risks distinct from text-only systems. This survey organizes fragmented research on VLA threats, defenses, evaluation, and deployment using parallel attack- and defense-timing axes.

  • VLA emergence: VLA models combine visual perception, natural-language understanding, and physical action generation, supporting generalized execution of manipulation tasks from language instructions.
  • Deployment motivation: Deployment is expanding into autonomous driving, healthcare, manufacturing, service delivery, and agriculture, where failures can cascade into serious safety incidents.
  • The VLA safety challenge: VLA safety differs from text-only LLM safety because embodiment creates potentially irreversible physical consequences, while multimodal inputs expose language, vision, and proprioceptive-state attack surfaces.
  • The VLA safety challenge: Real-time latency constraints can make safety interventions ineffective, and perception failures or adversarial perturbations can compound across long-horizon action sequences under distribution shift.
  • This survey: The survey unifies fragmented work through attack-time and defense-time taxonomies, reviews attacks, defenses, benchmarks, metrics, and six deployment domains, and identifies open needs including certified robustness and standardized evaluation.

2 Background

This section establishes the formal, architectural, training, and inference foundations of Vision-Language-Action models that support the survey’s later safety analysis. VLA systems combine multimodal observations and language conditioning with action generation, while their staged training and deployment interfaces create distinct safety-relevant threat surfaces.

  • Formal problem setting: VLA systems are formalized as POMDPs in which observations, actions, transitions, rewards, emissions, and discounting define robot manipulation under partial observability.The formal model is M = (S, A, T, R, O, Z, γ), with observations emitted from latent states.
  • Formal problem setting: At each timestep, observations combine RGB camera images with optionally available proprioceptive state, including joint positions, velocities, and end-effector pose.Some VLA models use visual observations exclusively, whereas others add joint state or gripper pose as input channels.
  • Safety relevance: The behavior-cloning formulation links foundational training to safety threats because adversaries can poison demonstration data or manipulate observations and language instructions during deployment.These correspond to training-time and inference-time attack surfaces, respectively.
  • Architecture: Modern VLA models use a three-component architecture: a visual encoder, a language backbone for multimodal reasoning, and an action decoder producing executable robot commands.The three components respectively extract visual features, integrate visual, linguistic, and state context, and translate representations into control actions.
  • Action decoding: Action decoders support token-based generation, continuous regression, and flow matching, trading off serving compatibility, control frequency, multimodal action modeling, and inference latency.Autoregressive token decoding can delay high-frequency control, while continuous and flow-based methods reduce sequential-generation overhead; flow matching can require fewer evaluations than standard DDPM-style diffusion.
  • Training paradigms: VLA training typically proceeds from web-scale vision-language pretraining to robot-demonstration fine-tuning, exposing models to corpus risks and dataset-specific safety implications.Open X-Embodiment aggregates approximately one million demonstrations across 22 robot embodiments from 21 institutions.

3 Training-Time Attack

Training-time attacks on VLA models implant hidden trigger-to-action mappings through poisoned demonstrations, exploiting visual-language alignment, physical objects, temporal dynamics, and proprioceptive states. These attacks can cause untargeted deviation, targeted hijacking, or persistent hazardous trajectories while preserving clean-task behavior or evading anomaly detection.

  • Data and multimodal backdoors: Poisoned demonstrations establish hidden mappings between visual, linguistic, physical, temporal, or state-level triggers and malicious actions.Triggers can include token-, pixel-, physical-object-, or state-level signals, producing untargeted deviation, targeted hijacking, or temporal-drift behaviors.
  • Data and multimodal backdoors: BadVLA separates adversarial gradients to preserve clean-task utility and stealth, whereas DropVLA uses composite visual and linguistic triggers for deterministic, state-conditional hijacking.GoBA extends the threat to tangible 3D objects, requiring no inference-time parameter access and potentially inducing persistent hazards from a physical trigger.
  • Temporal and sequential attacks: SilentDrift exploits action-chunking blind spots with a Smootherstep envelope, producing C2-continuous adversarial drift that can bypass physics-based anomaly detectors.The envelope is s(τ) = 6τ^5 − 15τ^4 + 10τ^3, with zero velocity and acceleration at the injected segment’s boundaries.
  • Temporal and sequential attacks: Clean-Action uses infinitesimal perturbations or transient pauses that compound across long-horizon sequences, sabotaging global objectives without changing local action labels.Together with SilentDrift, it demonstrates that attacks can exploit sequential dependencies and action-generation frequencies rather than static input anomalies.
  • Proprioceptive-state attacks: State Backdoor poisons initial proprioceptive configurations as stealthy triggers, using a Preference-guided Genetic Algorithm to balance attack effectiveness, clean functionality, and trigger stealthiness.The method constrains perturbations to remain close to the benign state distribution while inducing target actions under poisoned states.

4 Training-Time Defenses

Training-time VLA defenses increasingly treat safety as alignment during learning rather than post-hoc correction. They span safer data and reward design, explicit policy constraints, and human-feedback-based refinement.

  • Defense directions: Training-time defenses organize around safer learning signals, explicit safety constraints, and human feedback for correcting failure-prone behaviors.Examples include EvoVLA, SafeVLA, SORL, APO, and Hi-ORS.
  • Learning-signal design: Pedagogical supervision, self-evolving rollout training, and multimodal augmentation shape safer policies through meaningful progress signals, exploration, memory, consistency, and non-visible physical cues.Pedagogical Alignment and EvoVLA structure intermediate targets; GeRo supports long-horizon refinement; Safe-Night VLA adds thermal perception.
  • Policy optimization: SafeVLA formulates safety alignment as a constrained Markov decision process, unifying task optimization and safety satisfaction within training rather than using post-hoc penalties or deployment filters.Its Integrated Safety Approach links safety predicates, unsafe-behavior elicitation, cost construction, and multi-scenario evaluation to policy learning.
  • Policy optimization: SORL broadens policy-centric safety beyond CMDPs through multi-objective optimization and a safety critic estimating future discounted safety costs.The supplied passage introduces this formulation as a related, more general perspective to SafeVLA.
  • Human-in-the-loop refinement: Human-in-the-loop methods use structured corrective supervision for continual refinement; APO converts online interventions into binary action-preference supervision by labeling corrective actions desirable and prior actions undesirable.APO starts from a base VLA policy initialized with expert demonstrations.

5 Inference-Time Safety and Robustness

This section examines inference-time safety for Vision-Language-Action models through a taxonomy spanning attacks, defenses, and evaluations. It covers threats to perception and decision pipelines, low-latency physical fail-safes, reasoning-based semantic monitors, and benchmarks for quantifying safety and reliability.

  • Overview: Inference-time safety is organized into three components: attacks, defenses, and evaluations.The taxonomy maps representative research works and affiliated institutions to each sub-category.
  • Inference-Time Attacks: Inference-time attacks target VLA perception and decision pipelines through semantic jailbreaks and physical interventions.
  • Inference-Time Defenses: Inference-time defenses include low-latency physical fail-safes and reasoning-based semantic monitors.
  • Evaluation and Benchmarks: Evaluation and benchmarks quantify the safety and reliability of VLA systems.

5.1 Inference-Time Attacks

Inference-time attacks target deployed VLA perception and decision pipelines through semantic instructions, visual or digital inputs, and physical-environment interventions. These attacks exploit mismatches across semantic reasoning, multimodal representations, continuous control, and embodied state, producing consequences from action hijacking to operational paralysis.

  • Semantic jailbreaks: Semantic attacks exploit the mapping vulnerability between discrete language reasoning and continuous physical control, so textual alignment alone cannot guarantee physical safety.RoboPAIR reports semantic deception across permission settings, while BadRobot identifies the underlying architectural flaw as an “Output-Action Mismatch.”
  • Semantic jailbreaks: Under white-box conditions, gradient-guided search over token embeddings constructs discrete adversarial prompts that disrupt cross-modal attention and hijack the robot’s global action space.Continuous backpropagation is invalid for discrete prompts, motivating first-order Taylor approximations over token embeddings.
  • Visual and cross-modal attacks: Visual and cross-modal attacks induce representation drift that propagates from corrupted joint embeddings into continuous control, potentially collapsing confidence and freezing action execution.FreezeVLA defines action-freezing as a severed perception-action link that makes the model ignore subsequent instructions and causes total operational paralysis.
  • Visual and cross-modal attacks: Physical-world visual injections exploit trust-boundary confusion by placing deceptive signs or printed text in the workspace, enabling attackers to hijack execution without digital access.VLAs struggle to distinguish legitimate user intent from untrusted environmental text.
  • Physical-environment attacks: Physical-environment attacks manipulate state, sensors, or execution: State Backdoor poisons real-world state, Phantom Menace injects optical patterns, and SilentDrift exploits action chunking.These interventions target navigation landmarks, data acquisition before digital processing, and continuous-control waypoint sequences.

5.2 Inference-Time Defenses

Inference-time VLA defenses use plug-and-play guardrails to mitigate runtime threats without retraining, but must balance safety against latency and baseline task utility. The literature therefore favors decoupled architectures combining semantic reasoning with high-frequency physical safeguards.

  • Core trade-offs: Inference-time guardrails address runtime threats without retraining, while facing inherent safety-latency and safety-performance trade-offs.Excessive defense latency can reduce control frequency and induce collisions, whereas overly conservative mechanisms can degrade nominal task success.
  • Dual-loop architecture: Decoupled dual-loop architectures pair a high-frequency Fast Reflexes loop for physical constraints with a low-frequency Slow Reasoning loop for semantic alignment.The reasoning loop operates at approximately 1Hz and can translate natural-language intent into formal constraints such as Signal Temporal Logic.
  • Decision-layer guardrails: Geometric planners such as AEGIS enforce collision avoidance rapidly with Control Barrier Functions, but their rigid constraints cannot natively handle dynamic non-geometric requirements and can cause over-refusal.RoboGuard instead uses LLM reasoning to translate open-vocabulary safety rules into formal temporal logic, sacrificing latency for semantic comprehension.
  • Runtime monitoring: Lightweight semantic and runtime interventions constrain dangerous commands or monitor execution, balancing rapid reaction with deeper diagnosis for unpredictable failures.HazardArena uses a training-free Safety Option Layer, while REFLECT and FailSafe use external VLMs to identify causes and halt or re-plan.
  • Execution-layer safeguards: Ultra-high-frequency controllers provide the final physical fail-safe by projecting hazardous commands onto safe boundaries and adapting forces during contact-rich manipulation.ATACOM operates at approximately 60Hz, while CompliantVLA dynamically modulates a Variable Impedance Controller for unexpected collisions.

5.3 Evaluation and Benchmarks

VLA safety evaluation is evolving from binary task success toward multidimensional certification of physical resilience, semantic alignment, human awareness, and operational integrity. It is also shifting from reactive failure analysis toward proactive self-awareness through latent-state monitoring and uncertainty calibration.

  • Safety Evaluation Dimensions: Evaluation now combines physical resilience, semantic alignment, and human-centric awareness rather than relying on binary task-success metrics.This multidimensional certification reflects the difficulty of assessing safety in dynamic, open-world environments.
  • Physical and Operational Benchmarks: VLA-Arena measures manipulation capability, VLA-Risk tests task success under multimodal perturbations, and Safety Q-score penalizes execution-time safety violations.Together, these benchmarks cover capability, physical robustness, and process integrity.
  • Contextual and Human-Centric Benchmarks: ASIMOV evaluates constitutional alignment, HazardArena tests contrasting semantic-risk scenarios, ICR-Drive probes linguistic robustness, and HRC benchmarks assess human action and emotion understanding.The benchmark ecosystem therefore extends from physical robustness to normative, contextual, linguistic, and human awareness.
  • Proactive Self-Awareness: Traditional methods such as VLATest and SAFE-SMART analyze execution boundaries or historical trajectories after the fact, limiting their ability to intercept imminent collisions.These approaches remain useful for offline refinement but are fundamentally reactive.
  • Proactive Self-Awareness: The SAFE framework monitors latent representational anomalies to detect impending failures in out-of-distribution scenarios before physical hazards materialize.This shifts evaluation toward proactive failure detection based on internal model states.
  • Uncertainty Calibration: Expected Calibration Error measures whether reported confidence aligns with true success probability, enabling a smart trigger between routine reflexes and slower VLM reasoning.Well-calibrated confidence supports continued autonomous execution when certainty is high and safe halting or escalation under ambiguity.

6 Evaluation

Safety evaluation is indispensable as VLA models move toward real-world deployment, because their emergent and opaque reasoning creates novel failure modes beyond conventional rule-based robotic constraints. The section surveys safety benchmarks and metrics for stress-testing VLA and embodied AI systems across diverse hazard categories.

  • 6 Evaluation: Real-world VLA deployment requires systematic safety benchmarking because emergent, opaque reasoning introduces novel failure modes not addressed by conventional rule-based constraints.The evaluation section first examines benchmarks and then metrics for quantifying safety performance.
  • 6.1 Safety Benchmarks: Safety benchmarks stress-test VLA and embodied AI systems across diverse hazard categories.These benchmarks are surveyed in Section 6.1.
  • 6.2 Evaluation Metrics: Evaluation metrics quantify safety performance after benchmark-based stress testing.The metrics are discussed in Section 6.2.

6.1 Safety Benchmarks

Safety benchmarks for VLA and embodied agents span adversarial robustness, hazardous-task planning, capability-and-safety trade-offs, jailbreaks, and runtime or semantic alignment. Across these evaluations, results expose multimodal vulnerabilities, failures to convert hazard recognition into safe execution, misleading memorization-based scores, and physically consequential jailbreaks.

  • Adversarial robustness: VLA-Risk evaluates multimodal adversarial robustness across 296 scenarios and 3,784 episodes, organizing attacks by object, action, and space dimensions.It covers both visual and linguistic input channels.
  • Adversarial robustness: Small adversarial patches can reduce task success by up to 100% in simulated and physical environments, while visual-sensor spoofing causes catastrophic perception and action failures.These findings demonstrate that both vision-language interfaces and sensors can compromise embodied execution.
  • Task-level safety: SafeAgentBench and AgentSafe evaluate hazard-aware planning across explicit, abstract, and long-horizon tasks, with AgentSafe diagnosing perception, planning, and execution separately.AgentSafe includes 45 adversarial scenarios, 1,350 hazardous tasks, and 9,900 instructions; its diagnostic protocol finds that agents may perceive hazards but fail during safe planning or execution.
  • Capability and safety: Capability-and-safety benchmarks broaden evaluation, but LIBERO’s reported accuracies above 90% can reflect memorization rather than genuine capability, while CostNav captures safety-relevant economic costs beyond collisions.VLA-Arena evaluates 170 tasks across safety, distractor robustness, extrapolation, and long-horizon reasoning; VLABench covers over 100 task categories and 2,000+ objects.
  • Jailbreak and alignment: Jailbreak benchmarks show that attacks can induce dangerous physical actions, reach the full VLA action space, persist over longer horizons, and improve attack success by 2.5× over BadRobot.Reported consequences include blocking emergency exits, locating weapons, deliberately colliding with people, and environmentally induced hazardous behavior.

6.2 Metrics

VLA safety evaluation spans task-level, behavioral, robustness, and composite metrics to capture harmful outcomes, execution quality, perturbation sensitivity, and deployment trade-offs. Existing metrics expose major gaps, including weak rejection capability, incomplete severity assessment, unresolved certified robustness, and attacks that persist across long horizons.

  • Metric categories: Safety evaluation is organized into task-level, behavioral, robustness, and composite metrics covering violations, behavior quality, perturbation degradation, and practical trade-offs.Table 6 summarizes the need to assess embodied safety beyond simple task success rates.
  • Task-level metrics: State-of-the-art systems achieve rejection rates as low as 10%, while task success rate contextualizes whether safety improvements rely on refusing useful tasks.Rejection Rate measures hazardous instructions correctly refused; Task Success Rate provides the counterbalance for safety–performance analysis.
  • Behavioral metrics: Collision rate treats all unintended contacts equally, whereas AgentSafe’s safety score decomposes failures across perception, planning, and execution for targeted diagnosis.The safety score is SS = α · spercep + β · splan + γ · sexec, with stage-specific scores and weighting coefficients.
  • Robustness metrics: RoboPAIR demonstrates ASR values reaching 100% for jailbreak attacks, while certified robustness remains difficult to adapt to sequential, multimodal VLA decision-making.Performance Drop Rate separately measures degradation relative to clean conditions under factors such as lighting, camera pose, and object distractors.
  • Composite and deployment metrics: Composite evaluation captures safety–performance trade-offs, deployment costs, pipeline vulnerabilities, and attack persistence that single binary metrics can miss.Cost-aware evaluation distinguishes cost categories such as collision damage, cargo spillage, and time penalties; textual jailbreak effects can persist across subsequent timesteps.

7 Real-World Deployment Scenarios

VLA safety is deployment-dependent: the consequences of hallucinations, unsafe instructions, and misgrounded actions vary across vehicles, homes, factories, hospitals, service settings, and outdoor environments. Across domains, safe deployment requires balancing capability with caution while addressing lifecycle drift, fleet interactions, and cascading failures.

  • Deployment-driven safety: Deployment safety must be evaluated by domain because identical VLA failures can have different consequences in vehicles, homes, factories, hospitals, and other settings.The section focuses on representative domains with qualitatively new safety concerns rather than exhaustively surveying all robotic applications.
  • Autonomous driving: Autonomous driving requires trustworthy language-conditioned reasoning under high-speed, high-consequence conditions, where hallucinated objects or traffic misinterpretations can cause phantom braking or missed pedestrians.Large-model computational cost also creates real-time constraints for driving safety.
  • Household robotics: Household robots must handle unstructured environments, vulnerable users, hazardous instructions, and long-horizon failures, while corrective failure cases suggest that failure awareness is learnable.SafeAgentBench found that agents may not reliably reject instructions such as placing bread on a stove and turning it on; FailSafe improved models including π0-FAST and OpenVLA through corrective-action training.
  • Industrial manufacturing and healthcare: Industrial and healthcare deployments tolerate little error because physical forces or clinical mistakes can cause severe injury, death, or irreversible patient harm, requiring standards, constraints, and specialized operating protocols.Industrial settings require force limiting, speed monitoring, and safety-rated stops, while healthcare settings add sterility, controlled interaction, occlusion, specialized lighting, and limited viewpoints.
  • Service and field deployment: Service and outdoor robots must combine socially appropriate navigation with robust perception across environmental variation, because grounding errors can produce delayed crop damage or environmental contamination.Outdoor conditions include sunlight, shadows, rain, dust, mud, terrain changes, sensor degradation, and long operating horizons.
  • Cross-domain deployment challenges: Safe deployment lies on a domain-dependent safety–capability Pareto frontier and must account for safety drift after updates, continuous monitoring, regression testing, accountability, and fleet-level cascading failures.Multi-agent safety extends beyond single-agent instruction following to coordination, shared situational awareness, and cascading failures.

8 Future Directions

Future VLA safety research should move beyond empirical, simulation-bound attack–defense studies toward certified trajectory robustness, physically grounded defenses, safety-aware training, unified runtime safeguards, standardized evaluation, and deployment governance. Across these directions, the overarching goal is a cumulative discipline built on shared threat models, reproducible benchmarks, theoretical frameworks, and safety designed in from the outset.

  • Certified robustness: Certified robustness must address jointly attacked visual, linguistic, proprioceptive, and physical channels while providing guarantees over entire trajectories rather than individual frames.Current defenses are predominantly empirical and lack formal guarantees over the full perturbation space.
  • Physical-world safety: Defenses should target physically realizable interventions, combining physically rendered adversarial training with multi-view consensus, proprioceptive feedback, and physical safeguards.Studied digital perturbations differ from deployment threats such as printed patches, object substitutions, lighting manipulation, and acoustic injection.
  • Safety-aware training: Safety-aware training should make safety explicit through alignment, curricula, and human preference refinement while preserving the broad behavioral coverage that gives VLA systems their value.Behavior-cloning pipelines leave learners vulnerable to data poisoning and backdoors, while integrating safety paradigms without sacrificing generalization remains challenging.
  • Unified runtime safety: A unified runtime architecture should integrate guardrails, closed-loop monitors, and physical fail-safes while adapting computation to heterogeneous latency budgets and supporting anytime safety.The proposed architecture must also arbitrate contradictory interventions and provide useful safety signals under interruption.
  • Evaluation and deployment: Standardized evaluation should combine shared scenarios and metrics with domain randomization, hybrid simulation–physical validation, and formal links to deployment-relevant guarantees.These priorities address fragmented benchmarks and the persistent gap between predominantly simulated evaluations and physical-world consequences.
  • Deployment and governance: Deployment research must detect safety drift and systemic fleet failures through regression suites, fleet-wide monitoring, coordination-aware policies, auditable architectures, risk-tiered evaluation, and liability frameworks.Governance and ethical issues—including privacy, equitable access, and accountability for autonomous harm—must be treated explicitly alongside technical safeguards.

9 Conclusion

VLA models are moving from research prototypes into deployed physical systems, making safety a concrete concern because multimodal perturbations can propagate into irreversible actions. The survey argues that safety must become a first-class design objective, supported by stronger evaluation, runtime mechanisms, and cross-disciplinary research.

  • Conclusion: VLA systems now span autonomous vehicles, household assistants, industrial manipulators, surgical robots, and field machinery, expanding safety consequences beyond software-reversible errors.Their unified perception, language, and action processing enables broader generalization while allowing perturbations in any modality to affect physical actions.
  • Conclusion: Existing benchmarks cover training- and inference-time threats, while runtime-alignment suites extend evaluation into operational settings; however, metrics remain heterogeneous.The survey identifies VLA-Risk, VLATest, SafeAgentBench, AgentSafe, ASIMOV, SAFE-SMART, and SAFE as established evaluation resources.
  • Conclusion: Urgent priorities include trajectory-level certified robustness, physically realizable attacks and defenses, safety-aware training, unified runtime architectures, reproducible evaluation, and sim-to-real safety transfer.The survey also highlights continuous learning under safety drift, fleet-level safety, and regulatory alignment.
  • Conclusion: The survey’s taxonomies may require extension as new attacks, defenses, physical threats, and fleet-level risks emerge, and several topics warrant dedicated future surveys.The authors emphasize breadth over depth where research remains nascent, especially for certified robustness, runtime monitoring, and regulatory integration.
  • Conclusion: Because VLA models are leaving the laboratory and the window for retrofitting safety is narrow, safety should be designed alongside capability, efficiency, and generalization.The survey frames safety as no longer speculative and aims to orient researchers, practitioners, and policymakers entering the field.
Loading 2604.23775v1…