PaperlayerView exact revision on arXiv

Source-linked AI summary

Vision-Language-Action Safety: Threats, Challenges, Evaluations, and Mechanisms

Qi Li, Bo Yin, Weiqi Huang, Ruhao Liu, Bojun Zou, Runpeng Yu, Jingwen Ye, Weihao Yu, Xinchao Wang

arXiv:2604.23775v2cs.RO

TL;DR

VLA systems create safety challenges because multimodal perturbations can propagate into consequential physical actions, while the literature remains fragmented. This survey unifies threats, defenses, evaluations, and deployment challenges along attack- and defense-timing axes, identifying physically realizable defenses, runtime safety architectures, and standardized evaluation as open priorities.

  • Problem

    VLA deployment in consequential domains creates multimodal safety challenges, while existing research remains fragmented across relevant fields.

  • Method

    The survey synthesizes VLA safety literature through parallel attack- and defense-timing axes spanning attacks, defenses, evaluation, and deployment.

  • Results

    The survey finds that VLA safety spans digital and physical attacks, runtime and training-time defenses, deployment-specific hazards, and gaps in current evaluation.

  • Takeaways & Limitations

    Reliable VLA deployment requires defenses and evaluations that address physically realizable multimodal attacks, long-horizon planning, and consequential human interaction.

  • Takeaways & Limitations

    Geometric guardrails cannot natively process dynamic, non-geometric constraints and may over-refuse valid actions, degrading nominal task performance.

Abstract

from arXiv · show

Vision-Language-Action (VLA) models are emerging as a unified substrate for embodied intelligence. This shift raises a new class of safety challenges, stemming from the embodied nature of VLA systems, including irreversible physical consequences, a multimodal attack surface across vision, language, and state, real-time latency constraints on defense, error propagation over long-horizon trajectories, and vulnerabilities in the data supply chain. Yet the literature remains fragmented across robotic learning, adversarial machine learning, AI alignment, and autonomous systems safety. This survey provides a unified and up-to-date overview of safety in Vision-Language-Action models. We organize the field along two parallel timing axes, attack timing (training-time vs. inference-time and defense timing (training-time vs. inference-time, linking each class of threat to the stage at which it can be mitigated. We first define the scope of VLA safety, distinguishing it from text-only LLM safety and classical robotic safety, and review the foundations of VLA models, including architectures, training paradigms, and inference mechanisms. We then examine the literature through four lenses: Attacks, Defenses, Evaluation, and Deployment. We survey training-time threats such as data poisoning and backdoors, as well as inference-time attacks including adversarial patches, cross-modal perturbations, semantic jailbreaks, and freezing attacks. We review training-time and runtime defenses, analyze existing benchmarks and metrics, and discuss safety challenges across six deployment domains. Finally, we highlight key open problems, including certified robustness for embodied trajectories, physically realizable defenses, safety-aware training, unified runtime safety architectures, and standardized evaluation.

1 Introduction

VLA models unify visual perception, language understanding, and physical action generation, enabling broad robotic generalization while expanding into consequential real-world domains. Their safety risks arise from embodiment, multimodal attacks, real-time constraints, long-horizon error propagation, and vulnerable training-data pipelines, motivating this survey’s unified taxonomy and review.

  • 1 Introduction: VLA models unify visual perception, natural-language understanding, and physical action generation, achieving broad task generalization and expanding into driving, healthcare, manufacturing, service, and agricultural robotics [31] [50] [77] [87] [92].These deployments include trajectory planning, surgical assistance, eldercare, and tasks where mechanical or behavioral errors can cascade into serious incidents.
  • 1 Introduction: VLA safety differs from text-only LLM safety because embodied actions can cause irreversible physical harm, while attacks span language, vision, and proprioceptive state inputs [73].Examples include adversarial patches, textual jailbreaks, and state-space backdoors.
  • 1 Introduction: Real-time latency constraints can make safety interventions ineffective, and perception failures or perturbations can compound across long-horizon trajectories under distribution shift.The training-data supply chain adds another distinctive vulnerability because demonstrations may come from diverse, unvetted sources.
  • 1 Introduction: The fragmented literature spans robotic learning, adversarial machine learning, AI alignment, and autonomous-systems safety, with limited integration across training-time and inference-time threats.Backdoors, adversarial perturbations, and jailbreaks have largely been studied independently of one another and of embodied-system constraints.
  • 1 Introduction: This survey organizes threats and defenses by attack and defense timing, reviews attacks, mechanisms, benchmarks, metrics, and deployment domains, and identifies certified robustness, physically realizable defenses, safety-aware training, and standardized evaluation as open priorities.Its coverage includes poisoning, backdoors, adversarial perturbations, jailbreaks, freezing attacks, benchmark gaps, and safety challenges across six deployment domains.

2 Background

VLA systems combine visual, language, and proprioceptive inputs with action decoders to produce robot control under a POMDP formulation. Their training and inference designs create safety-relevant exposure through poisoned demonstrations, decoding latency, and action-chunk visual blind spots.

  • Architecture: Modern VLA models use visual encoders, language backbones, and action decoders to transform multimodal observations and task instructions into executable robot commands.Visual features are integrated with language and optionally proprioceptive state before token-based, continuous, or flow-matching action generation.
  • Inference mechanisms: Token-based decoding inherits language-model infrastructure but incurs autoregressive latency that scales with action dimensionality, hindering high-frequency control.Continuous regression can instead produce action vectors in one forward pass, enabling higher control frequencies.
  • Training paradigms: Approximately one million Open X-Embodiment demonstrations span 22 robot embodiments and 21 institutions, illustrating the scale and heterogeneity of robot-demonstration fine-tuning.The collection supports behavior-cloning adaptation of pretrained backbones across diverse embodiments.
  • Training paradigms: LoRA fine-tuning remains vulnerable to poisoned datasets: attackers can embed malicious behaviors through a Training-as-a-Service interface without accessing full model parameters.The vulnerability arises during robot-demonstration adaptation, despite most pretrained parameters remaining frozen.
  • Inference mechanisms: Action chunking predicts H future actions in one pass, but open-loop execution creates an intra-chunk visual blind spot that adversaries can exploit.The robot acts without re-observing its environment until the next chunk is processed.

3 Training-Time Attack

Training-time attacks on VLA models evolve from poisoned multimodal triggers to stealthy temporal, physical, and proprioceptive exploits. These attacks can preserve clean-task behavior while inducing harmful trajectories through cross-modal alignment gaps, smooth action drift, compounded errors, or state-dependent triggers.

  • Multimodal and physical backdoors: Training-time backdoors exploit visual-language alignment by mapping token, pixel, physical-object, or state triggers to untargeted deviations or targeted malicious actions.BadVLA separates adversarial gradients to preserve clean-task utility and stealth, while DropVLA uses composite visual and linguistic triggers for deterministic, state-conditional hijacking.
  • Multimodal and physical backdoors: Physical-object triggers can hijack robotic policies through sparse mislabeled interactions, inducing persistent real-world hazards without inference-time model-parameter access.GoBA associates tangible 3D entities with malicious goal-oriented trajectories during training, creating a black-box threat activated when the object enters the agent’s field of view.
  • Temporal and sequential attacks: SilentDrift weaponizes action-chunking open-loop windows with Smootherstep perturbations whose C2 continuity produces dynamically smooth adversarial drift that can bypass physics-based anomaly detectors.The envelope has zero velocity and acceleration at the injected segment’s boundaries, exploiting visual blind spots in architectures such as OpenVLA and π0.
  • Temporal and sequential attacks: Clean-Action uses infinitesimal perturbations or transient pauses that compound across long-horizon sequences, sabotaging global objectives without changing local action labels.Together with SilentDrift’s intra-chunk hijacking, this demonstrates that VLA security depends on detecting non-stationary, time-varying adversarial dynamics in the control loop.
  • Proprioceptive-state attacks: State Backdoor uses initial proprioceptive joint configurations as stealthy triggers, with a Preference-guided Genetic Algorithm balancing attack effectiveness, clean functionality, and trigger stealthiness.The method searches for state perturbations that induce target actions while preserving benign-state behavior and keeping perturbations near the benign state distribution.

4 Training-Time Defenses

Training-time VLA defenses increasingly frame safety as alignment during learning rather than post-hoc correction, spanning safer data and rewards, explicit policy constraints, and human-feedback refinement. These approaches target cross-modal policy formation before unsafe associations consolidate, while also addressing long-horizon exploration, perception, optimization, and post-training failures.

  • Defense directions: Training-time defenses comprise safer learning signals, explicit safety constraints, and human-feedback refinement, marking a shift from robustness mitigation toward alignment during learning.This organization includes EvoVLA, SafeVLA, SORL, APO, and Hi-ORS.
  • Training-signal shaping: Safer training signals use pedagogical supervision, self-evolving rollout design, and multimodal augmentation to structure progress, stabilize long-horizon refinement, and reduce perceptual ambiguity.Pedagogical Alignment and EvoVLA provide stage-aware supervision; EvoVLA and GeRo [83] use exploration, memory, and consistency-aware rollouts; Safe-Night VLA adds non-visible physical cues.
  • Training-signal shaping: EvoVLA addresses stage hallucination and long-horizon unreliability through stage-aligned rewards, video-driven stage discovery, geometric exploration, memory, and PPO-based refinement.Its Pose-Based Object Exploration defines signals from relative gripper–object geometry rather than raw pixel novelty, guiding extended rollouts with stage-consistent intrinsic feedback.
  • Training-signal shaping: Safe-Night VLA expands the perceptual basis for safety-critical manipulation by addressing physically relevant states that RGB observations alone cannot capture.The supplied passage identifies long-wave infrared thermal perception as part of this approach.
  • Policy optimization and refinement: Policy-centric defenses encode safety directly into learning: SafeVLA uses a CMDP and integrated safety process, while SORL uses multi-objective optimization and a safety critic.SafeVLA unifies task optimization and safety satisfaction rather than relying on post-hoc penalties or deployment-time filters; the passage also identifies VLA-Forget [53] and Hi-ORS as post-training policy defenses.
  • Human-in-the-loop refinement: Human-in-the-loop methods treat intervention as corrective supervision: APO converts online corrections into binary action-preference data for continual policy refinement.APO relabels corrective actions as desirable and preceding policy actions as undesirable, starting from expert-demonstration initialization.

5 Inference-Time Safety and Robustness

This chapter examines inference-time safety and robustness for VLA models during deployment, organizing the topic into attacks, defenses, and evaluations. It covers threats to perception and decision pipelines, low-latency fail-safes and semantic monitors, and benchmarks for quantifying safety and reliability.

  • Overview: Inference-time safety is organized into three components: attacks, defenses, and evaluations.Figure 6 also maps representative research works and affiliated institutions to each sub-category.
  • 5.1 Inference-Time Attacks: Inference-time attacks target VLA perception and decision pipelines, including semantic jailbreaks and physical interventions.
  • 5.2 Inference-Time Defenses and 5.3 Evaluation and Benchmarks: Inference-time defenses include low-latency physical fail-safes and reasoning-based semantic monitors, while evaluations use benchmarks to quantify VLA safety and reliability.

5.1 Inference-Time Attacks

Inference-time attacks on VLA models target semantic interfaces, cross-modal perception, and the physical environment, exploiting mismatches between reasoning and continuous control. These attacks range from prompt-based deception and adversarial visual inputs to physical interventions that disrupt navigation, sensing, or execution.

  • Semantic jailbreaks: Semantic attacks exploit the mapping between language reasoning and physical control, revealing that textual alignment alone cannot guarantee physical safety [56] [93].RoboPAIR reports semantic deception across permission settings, while BadRobot identifies the underlying Output-Action Mismatch.
  • Semantic jailbreaks: White-box prompt attacks use gradient-guided discrete token search to disrupt cross-modal attention and hijack the robot’s global action space [32].Because prompts are discrete, attackers optimize token sequences through first-order approximations over token embeddings rather than direct continuous backpropagation.
  • Visual and cross-modal attacks: Cross-modal visual attacks induce representation drift that can sever perception-action links, causing instruction-ignoring action freezing and operational paralysis [73] [81] [74].VLA-Fool corrupts the joint embedding space, while FreezeVLA defines the resulting action-freezing phenomenon.
  • Physical-environment attacks: Physical-world attacks exploit environmental inconsistency through displaced landmarks, state backdoors, deceptive signs, optical signal injection, and action-chunking vulnerabilities [10] [46].These interventions can target navigation state, real-world triggers, sensor acquisition, or continuous-control execution without requiring digital access.

5.2 Inference-Time Defenses

Inference-time defenses use plug-and-play guardrails and decoupled control architectures to mitigate runtime threats without retraining, but must balance safety against latency and task performance. Existing methods span semantic reasoning, heuristic monitoring, geometric filtering, and ultrahigh-frequency physical safeguards.

  • Core challenges: Inference-time guardrails face a fundamental safety-latency trade-off: excessive defense computation can reduce control frequency and induce the collisions it aims to prevent.They also face a safety-performance trade-off, because overly strict mechanisms can degrade nominal task success [24].
  • Dual-loop architecture: A decoupled dual-loop architecture combines a high-frequency Fast Reflexes loop for physical constraints with a low-frequency Slow Reasoning loop for semantic alignment.The slow loop uses VLM monitoring and LLM translation into formal constraints such as Signal Temporal Logic, while the fast loop prioritizes execution-level safety.
  • Runtime monitoring: Lightweight runtime interventions address unpredictable failures through heuristic masking, occupancy-aware collision prediction, and rollback to safe states [21] [88] [79].These closed-loop approaches must balance reaction speed with reasoning depth because diagnosis latency can itself cause collisions.
  • Execution-layer safeguards: Ultrahigh-frequency execution layers provide physical fail-safes by projecting hazardous commands onto safe boundaries at roughly 60Hz [66] and dynamically modulating compliant control forces [94].These mechanisms apply hardware or force constraints directly to executed commands, supporting rapid adaptation beyond autoregressive VLA rates.

5.3 Evaluation and Benchmarks

VLA safety evaluation is evolving from binary task success toward multidimensional certification spanning physical resilience, semantic alignment, human awareness, and self-awareness. This shift combines contextual benchmarks with proactive uncertainty calibration to detect hazards and trigger safer behavior before failures materialize.

  • Evaluation and benchmarks: Evaluation has progressed beyond binary success metrics toward certification of physical resilience, semantic alignment, and self-awareness.Table 5 consolidates representative benchmarks, target scenarios, and core metrics.
  • Evaluation and benchmarks: Embodied safety evaluation is maturing into a contextual, multidimensional ecosystem spanning physical robustness, process integrity, constitutional alignment, semantic and linguistic robustness, and human awareness.Representative benchmarks include VLA-Risk, ASIMOV, HazardArena, ICR-Drive, and human-robot collaboration evaluations.
  • Self-awareness and calibration: Traditional post-hoc methods map execution boundaries or verify historical trajectories, but they cannot intercept imminent physical collisions in real time.VLATest uses injected perturbations, while SAFE-SMART applies Signal Temporal Logic for offline trajectory verification [75] [58].
  • Self-awareness and calibration: The SAFE framework uses latent features to continuously detect representational anomalies and impending failures in out-of-distribution scenarios before physical hazards materialize [17].This provides a proactive evaluation mechanism rather than relying only on reactive failure counting.
  • Self-awareness and calibration: Calibrated uncertainty enables a VLA to use high-frequency reflexes for routine tasks while halting or invoking slower VLM reasoning under ambiguity.Expected Calibration Error measures alignment between empirical accuracy and reported confidence [106], serving as the smart trigger for the dual-loop architecture.

6 Evaluation

As VLA models move from controlled laboratories toward real-world deployment, rigorous safety evaluation is essential because their emergent, opaque reasoning creates novel failure modes beyond rule-based robotic constraints. This section surveys safety benchmarks proposed to stress-test VLA models.

  • 6 Evaluation: Real-world deployment makes rigorous safety evaluation indispensable for VLA models.
  • 6 Evaluation: VLA models introduce novel failure modes through emergent and often opaque reasoning capabilities.
  • 6.1 Safety Benchmarks: The section surveys existing safety benchmarks designed to stress-test VLA models.

6.1 Safety Benchmarks

VLA safety benchmarks span adversarial robustness, task-level safety, integrated capability-and-safety evaluation, jailbreak and alignment, and runtime monitoring or semantic alignment. Results reveal severe weaknesses in adversarial resilience, hazard recognition, safety-aware planning, and resistance to textual or environmental jailbreaks.

  • Benchmark taxonomy: Benchmarks are organized into five focuses: adversarial robustness, task-level safety, capability-and-safety, jailbreak and alignment, and runtime monitoring or semantic alignment.Table 5 summarizes representative benchmarks across these categories.
  • Adversarial robustness: Adversarial evaluations expose major vulnerabilities: vision-language attacks reduce task success by up to 100%, while VLATest reports very low success rates under diverse scene and instruction perturbations.VLA-Risk evaluates 296 scenarios and 3,784 episodes across object, action, and space dimensions and visual and linguistic channels; VLATest evaluates seven VLA models, with reported average success rates including 12.4%, 6.0%, and 1.2%.
  • Capability and evaluation validity: Integrated evaluations expose capability-safety and methodological failures, including safety-relevant weaknesses in long-horizon reasoning and misleadingly high LIBERO accuracies above 90% caused by memorization.VLA-Arena evaluates 170 tasks across safety, distractor robustness, extrapolation, and long-horizon reasoning, while LIBERO-PRO introduces perturbations to address reused training and evaluation configurations.
  • Jailbreak and alignment: Jailbreak benchmarks demonstrate severe attackability: RoboPAIR reaches 100% attack success across white-, gray-, and black-box settings, while textual and environmental attacks can sustain or amplify hazardous behavior.Textual jailbreaks achieve full action-space reachability and persist over longer horizons; Shawshank improves attack success 2.5× over BadRobot, and a 230-query suite finds susceptibility across multiple robotic frameworks.

6.2 Metrics

VLA safety evaluation spans task-level, behavioral, robustness, and composite metrics, capturing violations, execution quality, perturbation sensitivity, and safety–performance trade-offs. Existing metrics also expose important limitations, including severity-blind collision counts, planning-stage vulnerabilities, persistent attacks, and the unresolved challenge of certifying robustness for sequential multimodal decisions.

  • Task-level safety metrics: Safety evaluation combines task-level outcomes such as SVR and RejR with task success rate, which contextualizes the safety–performance trade-off.SVR counts episodes containing at least one predefined safety violation, while RejR measures correct refusal of hazardous instructions.
  • Task-level safety metrics: Rejection rates can be as low as 10% for current state-of-the-art systems, showing severe deficits in recognizing and refusing hazardous instructions [84].
  • Behavioral safety metrics: Behavioral metrics assess execution quality: collision rate captures unintended contacts but treats all collisions equally [59], whereas AgentSafe’s score decomposes perception, planning, and execution safety [85].The decomposition SS = α · spercep + β · splan + γ · sexec helps identify the pipeline stage where failures originate.
  • Robustness metrics: Robustness metrics quantify attack success and degradation under perturbations: RoboPAIR reports jailbreak ASR values reaching 100% [56], while VLATest measures sensitivity to lighting, camera pose, and distractors [75].Certified robustness remains an open challenge because VLA decisions are sequential and multimodal.
  • Composite metrics: Holistic evaluation models safety as a Pareto trade-off between success and violations or rejection, while cost-aware frameworks distinguish minor scrapes from catastrophic equipment damage [59].Ideal models occupy the high-success, low-violation region, but greater safety awareness often reduces task success.
  • Composite metrics: Temporal persistence matters because jailbreak effects can continue across subsequent timesteps, causing single-timestep metrics to underestimate adversarial risk [32].Safe-Diagnose also reports stage-specific hazard detection, constraint satisfaction, and physical outcome quality, identifying planning as a primary vulnerability [85].

7 Real-World Deployment Scenarios

VLA safety is deployment-dependent: failures that appear similar at the model level can have different consequences across vehicles, homes, factories, hospitals, service environments, and fields. Across these settings, safety is shaped by physical context, vulnerable users, long-horizon effects, simulation-to-reality gaps, domain-specific tradeoffs, regulation, and fleet interactions.

  • Driving: Driving requires trustworthy language-conditioned reasoning under high-speed, high-consequence conditions, where hallucinations, traffic-semantic errors, and computational costs can cause unsafe decisions [31] [65].Reported risks include phantom braking and failure to detect pedestrians; latency and real-time response further constrain safe deployment.
  • Household Robotics: Household robots face open-world variation, ambiguous instructions, long-horizon manipulation, vulnerable users, and hazardous environments, while current models favor memorization over systematic generalization [90] [102].SafeAgentBench [84] finds that agents may fail to reject explicitly hazardous instructions, and AgentSafe [85] shows that hazard perception may not become safe extended plans; close interactions can involve excessive force, dropped objects, or collisions [15].
  • Manufacturing and Healthcare: Factories and clinical settings require multimodal reasoning that preserves human and patient safety, because shared-workspace failures and surgical misidentification, ambiguous commands, or incorrect-force handovers can cause direct or irreversible harm [69].Safe reinforcement learning offers constraint-based control, but adapting such constraints to multimodal VLA reasoning remains open.
  • Service Robotics: Service robots must combine social navigation and task planning with resistance to bystanders who manipulate environments or issue misleading instructions, including environmental jailbreaks induced without explicit malicious prompts [61] [5] [35].VLM-Social-Nav [61] improves success and reduces collisions by providing contextual social cost terms, while LLM planning [5] decomposes service requests under environmental and social constraints.
  • Agriculture: Agricultural deployment amplifies perception and grounding risks through outdoor variation and long horizons, where misidentifying crops, weeds, or treatment regions can cause delayed crop damage or environmental contamination [104].Current agriculture-specific VLA evidence remains relatively limited, while sunlight, rain, dust, terrain changes, sensor degradation, and mud complicate robustness.
  • Cross-Domain Deployment Challenges: Across domains, simulation guarantees may fail in physical deployment, safety must balance capability against domain-specific conservatism, and stochastic model updates and fleet interactions complicate certification, accountability, safety drift, and cascading failures.Physical systems introduce sensor noise, wear, latency, actuator uncertainty, and environmental variability; regulation for VLA-controlled systems remains underdeveloped, while fleets require coordination and shared situational awareness.

8 Future Directions

Future VLA safety research should move beyond empirical, simulation-bound attack–defense studies toward certified robustness, physically realizable defenses, safety-aware training, unified runtime protection, standardized evaluation, and governance. The overarching goal is a cumulative discipline with shared threat models, reproducible benchmarks, theoretical guarantees, and safety built in from the outset.

  • Certified Robustness: Certified robustness must cover jointly attacked visual, linguistic, proprioceptive, and physical channels across entire trajectories rather than individual frames.Existing defenses are predominantly empirical and lack formal guarantees over the full cross-modal perturbation space.
  • Physical Defenses: Defenses should address physically realizable interventions—including printed patches, object substitutions, lighting manipulation, and acoustic injection [35] [56]—using rendered adversarial data and multi-view, proprioceptive checks.Current digital threat models do not adequately represent deployment conditions.
  • Safety-Aware Training: Safety-aware training should replace implicit safety in behavior cloning with explicit policy constraints, constitutional or red-team alignment, and defenses against poisoning and backdoors [69].These approaches target vulnerabilities introduced by demonstration-driven training pipelines.
  • Unified Runtime Safety: A unified runtime architecture should adapt computation to heterogeneous latency budgets, arbitrate conflicting guardrails, and preserve useful safety signals under interruption.Decision-layer guardrails, closed-loop monitors, and physical fail-safes are currently studied in isolation; autonomous driving may require sub-100 ms responses, whereas household manipulation permits longer budgets.
  • Evaluation and Deployment: Standardized evaluation should combine shared scenarios and metrics with domain randomization, targeted physical validation, and formal links between simulation results and deployment guarantees.The proposed evaluation scope includes hazardous instructions, visual perturbations, environmental jailbreaks, long-horizon plans, success rate, collision rate, rejection rate, STL satisfaction, and ECE.
  • Continual Learning, Fleets, and Governance: Future systems need safety regression suites for continual updates, fleet-wide monitoring and coordination-aware policies for multi-agent failures, and auditable governance frameworks assigning responsibility across developers, integrators, and operators [75] [85].These priorities address safety drift, cascading fleet failures, regulatory review, privacy, equity, and accountability for autonomous harm.

9 Conclusion

VLA models are moving into real-world deployment, making multimodal safety urgent because perturbations can propagate into irreversible physical actions. The survey organizes current threats, defenses, evaluations, limitations, and priorities for making safety a first-class design objective.

  • VLA deployment across vehicles, assistants, manipulators, surgical robots, and field machinery makes safety urgent because multimodal perturbations can produce irreversible physical actions.
  • The survey covers training-time poisoning, backdoors, and action-chunking exploits alongside inference-time jailbreaks, multimodal perturbations, and physical interventions, plus corresponding data, optimization, and human-in-the-loop defenses.
  • Evaluation is maturing unevenly: VLA-Risk, VLATest, SafeAgentBench, AgentSafe, ASIMOV, SAFE-SMART, and SAFE broaden coverage, while metrics remain heterogeneous.The literature and safety-focused studies have grown rapidly, particularly after 2024.
  • The survey prioritizes certified embodied robustness, physically realizable attacks and defenses, safety-aware training, unified runtime architectures, reproducible evaluation, sim-to-real transfer, safety drift, fleet safety, and regulatory alignment.
  • The review is necessarily provisional because the rapidly expanding literature may require broader taxonomies and deeper dedicated surveys of certified robustness, runtime monitoring, and regulatory integration.
  • Because the window for retrofitting safety into deployed VLA systems is narrow, safety should be treated as a first-class objective alongside capability, efficiency, and generalization.
Loading 2604.23775v2…