ReasonBreak: Probing Vulnerabilities in Reasoning-Enabled Vision-Language-Action Models for Autonomous Driving
arXiv:2605.29114v1 [cs.CR] 27 May 2026
Mohammadreza Teymoorianfard University of Massachusetts Amherst [email protected] Jonathan Petit Qualcomm [email protected]
Jean-Philippe Monteuuis Qualcomm [email protected] Amir Houmansadr University of Massachusetts Amherst [email protected]
Abstract Vision-Language-Action (VLA) models with integrated reasoning have been proposed for end-to-end autonomous driving, assuming a tight coupling between reasoning and trajectory generation. However, the robustness of such systems under realistic input perturbations remains largely unexplored. We show that these models are highly vulnerable to realistic input perturbations, achieving up to 89% attack success rate (ASR) on reasoning and up to 72% on trajectory manipulation in closed-loop simulation, leading to increased collision rates and degraded safety metrics. Using NVIDIA’s recent Alpamayo models as representative industry-developed VLAs, we conduct the first systematic black-box study of reasoning-enabled VLA models under realistic textual input corruptions, evaluating their impact on reasoning and driving behavior. We introduce a reasoning-aware evaluation framework capturing both semantic and structural aspects of reasoning, along with safety-centric measures. We also introduce a benchmark for evaluating attacks and defenses on reasoning–trajectory interactions in autonomous driving. Our results highlight the need for rigorous evaluation and improved defenses to ensure the safety of reasoning-enabled VLA systems in autonomous driving.
Input Construction
Reasoning VLA
Output Evaluation Reasoning
Non-text Input Perception Encoder
Text Encoder
Backbone
Slow down to keep distance to the lead vehicle.
Decomposition
Semantic Drift
Inflated
Slow down
Missing
DoS
Object: lead vehicle Relation: distance to vehicle Implication: collision risk Planning: slow down
You are a driving assistant.
Corrupted query generation -
Reasoning
Scrambling Capitalization Char Noise
Token Length
Collision Wrong Lane Offroad Near-Encounter
Trajectory yoU ARE A dIVNIRG AsTasNSIT
Safety Impact
Trajectory Deviation > 𝞭
TTC ↓
Adv Trajectory Benign Trajectory
Figure 1: ReasonBreak pipeline. We corrupt only the small textual input channel while keeping the dominant non-text fixed, then measure reasoning shifts, trajectory degradation, and safety impact. Preprint.
1
Introduction
Vision-Language-Action (VLA) models are emerging as a prominent direction for end-to-end autonomous driving. This trend is increasingly visible in industry-scale systems: NVIDIA’s Alpamayo family introduces reasoning-enabled VLA models that couple grounded reasoning with trajectory prediction [44, 32]. By incorporating language, VLA systems augment conventional end-to-end driving pipelines [4, 9, 15, 8, 7] with high-level context and task constraints [22, 3, 34, 56, 44]; recent variants further expose intermediate reasoning before action generation [14, 24, 51, 44]. The integration of reasoning into VLA-based driving systems introduces a new and largely unexplored dimension of risk, as intermediate reasoning is tightly coupled with downstream trajectory generation. However, existing studies on VLA vulnerabilities have primarily focused on robotic manipulation settings and models without explicit reasoning components [43, 55, 29, 28, 52, 21]. These settings differ fundamentally from autonomous driving in both objectives and failure modes. In driving systems, errors directly correspond to safety violations [35, 9] rather than task-level inaccuracies. As a result, the role of reasoning as a potential source of vulnerability in safety-critical autonomous driving systems remains largely unexplored. In real-world deployment, VLA-based driving systems may receive textual inputs through imperfect language interfaces, including speech-to-text transcription, in-vehicle dialogue systems, and downstream text preprocessing pipelines [2, 12, 47]. Such interfaces do not provide a clean, canonical text channel: environmental noise, speaker variability, accent differences, segmentation errors, and normalization artifacts can all change the surface form of the input text command [39, 37, 13, 40, 10, 5]. Consequently, VLA models such as Alpamayo, which operate on textual instructions, are naturally exposed to noisy and imperfect input text in realistic settings. Prior work has shown that autoregressive language models are sensitive to surface-form perturbations, where small changes to spelling, casing, or character composition can significantly alter model behavior, particularly in reasoning tasks [17, 1, 27]. Motivated by this observation, we study VLA vulnerabilities under a query-based black-box setting that reflects these practical constraints, and ask whether realistic input text perturbations can influence reasoning and lead to unsafe behavior. We find that corrupted inputs disrupt the intended reasoning–action coupling in reasoning-enabled driving VLAs: reasoning shifts and trajectory deviations are only weakly correlated, with manipulated reasoning often failing to induce corresponding control changes and large trajectory deviations sometimes occurring with little reasoning change. This exposes reasoning as a practically exploitable failure surface. Under closed-loop interaction, realistic textual corruptions achieve up to 72% ASR for trajectory manipulation and up to 62% ASR for semantic reasoning manipulation, while also inducing structural reasoning failures such as length inflation and denial-of-service (DoS), where model refuses to generate any token. These perturbations translate into safety-critical degradation, increasing downstream failures such as collisions, off-road behavior, and wrong-lane events. We make the following contributions: • First systematic study of reasoning vulnerabilities in VLA-based autonomous driving. We study reasoning-enabled VLA models in safety-critical autonomous driving using a safety-centric evaluation pipeline that combines fine-grained driving metrics (collision rate, near-encounter, time-to-collision) with reasoning-aware analysis. We find that (i) both reasoning and trajectory can be manipulated to induce unsafe behavior, (ii) reasoning and trajectory are weakly correlated under manipulated inputs despite architectural coupling, and (iii) RL post-training improves benign robustness but can amplify safety risks when attacks succeed. We further show that lightweight rule-based filtering substantially mitigates these vulnerabilities. • Reasoning as an attack surface under realistic black-box constraints. We identify reasoning as a distinct and previously underexplored attack surface in VLA systems, and show that both semantic and structural properties of reasoning (e.g., content and length) can be manipulated under realistic input perturbations. We study this in a constrained, query-based black-box setting with limited input control, and adapt reasoning attacks (e.g., slowdown and DoS) to demonstrate their impact on safety-critical behavior. • Benchmark and dataset for reasoning–safety evaluation in autonomous driving. We release the first benchmark and dataset for evaluating reasoning–safety interactions in VLA2
based autonomous driving, mapping input conditions to intermediate reasoning outputs and safety-critical outcomes.
2
Background and Related Work
2.1
Vulnerabilities of VLAs
Vision-Language-Action (VLA) models jointly process visual observations and language inputs to generate sequential actions, enabling end-to-end decision making in embodied settings [22, 3]. Recent work has explored such models in robotic manipulation [22, 34, 3, 46, 25] and autonomous driving [56, 54, 36, 45, 44]. In this work, we focus on Alpamayo [44], a recent reasoning-enabled VLA system for autonomous driving. Given their deployment in physical systems, VLA models expose multiple safety-critical attack surfaces that have recently been explored. Prior work has identified vulnerabilities at the perception level, including physical sensor attacks [29] and adversarial patches [28, 52, 42, 49], as well as at the model level through action-freezing [43] and backdoor attacks [55]. Language-based attacks can also induce unsafe behaviors [21], alongside agentic black-box frameworks that exploit model interactions [48]. More recently, multimodal attacks that jointly manipulate visual and textual inputs have been shown to amplify attack effectiveness and bypass alignment mechanisms [50]. However, existing studies on VLA vulnerabilities have primarily focused on robotic manipulation settings and models without explicit reasoning components [42, 50, 52]. These works typically target input-level or policy-level weaknesses and evaluate failures in terms of task-level degradation or trajectory deviation, where small errors do not necessarily imply unsafe behavior. In contrast, autonomous driving requires evaluating safety-critical outcomes, where even minor perturbations can lead to severe consequences [35, 9]. Recent work has examined robustness in autonomous-driving VLMs and language-driven driving systems, including black-box/visual attacks, decision-making robustness, and instruction counterfactual robustness [41, 53, 6, 18]. However, these studies do not address reasoning-enabled driving VLAs as dual-output systems, where textual corruptions may affect both intermediate reasoning and trajectory behavior. In this work, we study this gap. 2.2
Reasoning Vulnerabilities
With the emergence of reasoning capabilities in large language and vision-language models, recent work has begun to explore vulnerabilities introduced by this new attack surface [38]. Prior studies show that reasoning processes can be manipulated in multiple ways, such as inducing excessively long reasoning chains to increase latency (slowdown attacks) [23, 26] or disrupting reasoning through premature termination (denial-of-service attacks) [11]. These findings highlight that reasoning itself can be directly targeted to influence model behavior. However, these attacks are primarily studied in text-only settings, where reasoning is represented as free-form natural language. In contrast, reasoning in VLA models is grounded in structured, taskrelevant representations and tightly integrated with downstream action generation [44, 32]. Moreover, unlike LLMs and VLMs, reasoning in VLAs is not directly controllable through prompts, making it difficult to apply existing reasoning attacks in a straightforward manner. To date, reasoning as an attack surface in VLA models remains largely underexplored. TRAP [19] provides an initial step by showing that manipulating intermediate reasoning can influence downstream actions, but focuses on robotic manipulation settings and relies on perception-driven, white-box attacks. In contrast, we study reasoning-level vulnerabilities in VLA systems under a realistic black-box setting, with a focus on safety-critical autonomous driving.
3
Threat Model
Figure 2 illustrates our threat model: imperfect language interfaces can produce malformed text inputs that perturb outputs and lead to unsafe behavior. Adversary Goal: The adversary aims to induce deviations in the model’s behavior by manipulating its reasoning or trajectory outputs. Specifically, the goal is to influence reasoning (e.g., its semantic 3
1. Human Driver (Voice Command)
2. Language Interfaces
3. Imperfect Text Input
4. Reasoning-enabled Driving VLA
5. Unsafe Behavior
Figure 2: Threat model: imperfect language interfaces can expose reasoning-enabled driving models to malformed textual inputs, leading to unsafe behavior.
content or structure) or the predicted trajectory in a way that leads to degraded performance or unsafe outcomes. Adversary Capabilities: We assume a query-based black-box setting, where the adversary has no access to model parameters, architecture, internal states, logits, or confidence scores. The adversary can only interact with the model through input queries and observe its outputs, including generated reasoning and predicted trajectories. Assumptions: The adversary acts on the digital textual input received by the model, not on physical audio or visual sensors. Its control is restricted to semantically preserving corruptions: it cannot inject arbitrary malicious instructions or nonsensical tokens, and can only modify the surface form of an input through capitalization changes, word scrambling, or character-level noise.
4
Methodology
Figure 1 summarizes our pipeline: textual corruptions are applied while non-text inputs are fixed, and the reasoning and trajectory outputs are evaluated for attack success and downstream safety impact. 4.1
Problem Setup
We consider a reasoning-enabled VLA model f that maps multimodal inputs to both intermediate reasoning and trajectory outputs [44]. Given visual observations v and textual input t, the model produces reasoning r and trajectory τ : (r, τ ) = f (v, t). We study textual perturbations t′ ∈ T (t) that preserve the intended meaning of t while introducing small realistic variations, such as character-level noise or word-level modifications, keeping v fixed. The perturbed output is (r′ , τ ′ ) = f (v, t′ ), and our goal is to measure how such perturbations alter reasoning and trajectory behavior, and whether they induce safety-critical degradation. 4.2
Query-Based Perturbation Pipeline
Open-Loop (Capability Upper Bound). In the open-loop setting, we evaluate the extent to which model behavior can be manipulated under a query-based exploration of the perturbation space. Specifically, we adopt a Best-of-N strategy [20], where a sequence of perturbed inputs {ti }N i=1 , with ti ∼ T (t), are evaluated as: (ri , τi ) = f (v, ti ). The search terminates early if a predefined objective is satisfied. To obtain stable estimates, we repeat this process and aggregate results using bootstrap-style resampling [16]. This setting provides a controlled probe of model vulnerability, estimating the upper bound on attack success under constrained but adaptive perturbations. Closed-Loop (Deployment Realism). In the closed-loop setting, we evaluate perturbations under a realistic deployment regime without query-based search. At each simulation step k, we sample a 4
perturbed textual input t′k ∼ T (tk ) and query the model once: (rk , τk ) = f (vk , t′k ). The predicted trajectory is then applied in the simulator, influencing future observations vk+1 . Thus, unlike open-loop evaluation, closed-loop evaluation does not search over multiple perturbations at each step; it uses a single randomly corrupted input per model invocation. This design reflects real-time constraints, where the model is invoked at high frequency and multi-query exploration at each step would be unrealistic. It captures whether simple perturbations, without optimization or selection, can accumulate over time and lead to safety-critical outcomes under continuous interaction. Together, these two settings provide a complementary view: open-loop evaluation characterizes the manipulability of the model under exploration, while closed-loop evaluation measures the realized impact of perturbations under realistic deployment dynamics. 4.3
Objectives & Safety Impact
We evaluate textual perturbations on two output surfaces of reasoning-enabled VLA models: reasoning and trajectory. For reasoning, we measure semantic shifts across four task-relevant fields—object, relation, implication, and planning—as well as structural failures such as reasoning-length inflation and missing reasoning outputs. For trajectory, we measure perturbation-induced degradation relative to the model’s benign behavior on the same scenario, using ADE in open-loop evaluation and realized ego-position deviation in closed-loop evaluation. The precise reference definitions, thresholds, and attack success criteria are provided in Section 5. Safety is not an explicit attack objective. Instead, after identifying successful reasoning or trajectory manipulations, we quantify their downstream safety impact. In open-loop evaluation, we report collision rate, near-encounter rate, and minimum time-to-collision (min-TTC); in closed-loop evaluation, we report scenario-level AlpaSim metrics [33], including collision, off-road, and wrong-lane rate.
5
Evaluation Protocol and Success Criteria
Existing VLA robustness studies largely target task-level failures in robotic manipulation, often without explicit reasoning outputs [43, 55, 29, 28, 52, 21]. In contrast, reasoning-enabled autonomousdriving VLAs expose two coupled but distinct surfaces: reasoning and trajectory. We therefore introduce an evaluation protocol that defines attack success over semantic reasoning shifts, structural reasoning failures, trajectory degradation, and closed-loop rollout failures. Throughout this section, C denotes a binary per-target success condition, and Acl denotes rollout-level closed-loop success. 5.1
Output-Surface Success Conditions
Reference. For each scenario, let v be the visual input, t the clean text, and t′ its perturbed counterpart. Let (r0 , τ 0 ) and (r′ , τ ′ ) denote the model outputs under clean and perturbed text, respectively: (r0 , τ 0 ) = f (v, t), (r′ , τ ′ ) = f (v, t′ ). We use (r0 , τ 0 ) as the benign reference. Reasoning Evaluation. We evaluate semantic and structural changes in reasoning. For semantic evaluation, an LLM-based evaluator decomposes each reasoning output into four task-relevant fields: object, relation, implication, and planning, capturing the key entity affecting the driving decision, its relation to the ego vehicle, the implied risk or constraint, and the planned action. For example, “Slow down to keep distance to the lead vehicle” is decomposed as: object: lead vehicle; relation: distance to vehicle; implication: collision risk; and planning: slow down. c For each target field c, the evaluator assigns a semantic deviation score Ssem (r′ , r0 ) ∈ [0, 1], where larger values indicate greater semantic change from the benign reasoning. For structural evaluation, we consider slowdown, where r′ is substantially longer than r0 , and DoS, where the model produces no reasoning tokens.
5
For a reasoning target c, we instantiate the binary success condition as: 1 S c (r′ , r0 ) > δsem , c ∈ {obj, rel, impl, plan, all}, sem |r ′ | CcReason (r′ , r0 ) = 1 |r , c = slowdown, 0| > ρ 1(|r′ | = 0) , c = DoS. Here, δsem is the semantic-deviation threshold, ρ is the slowdown threshold, and |r| denotes the number of generated reasoning tokens. Trajectory Evaluation. We evaluate trajectory degradation with a setting-specific error dtraj (·, ·) computed against the ground truth. In open-loop evaluation, dtraj is ADE between the predicted and ground-truth trajectories, following prior work [44]; in closed-loop evaluation, it is the distance between the realized ego position and the corresponding ground-truth position at each time step. Let o0 denote the benign trajectory output or ego state, o′ the corresponding output under perturbation, and ogt the ground truth. We define the perturbation-induced excess trajectory error as etraj = dtraj (o′ , ogt ) − dtraj (o0 , ogt ). The trajectory success condition is Traj Cdev = 1(etraj > δtraj ) ,
where δtraj is the trajectory-degradation threshold. Thus, a trajectory attack succeeds only when the perturbation causes additional error beyond the model’s nominal behavior. 5.2
Attack Success Rate (ASR)
ASR is defined differently for open- and closed-loop settings. Open-loop. Given N queried perturbations {ti }N i=1 , an attack succeeds if any query satisfies the target condition: h i (s,c) ASR(s,c) =1 , open = E 1 ∃i ≤ N : Ci (s,c)
where s ∈ {Reason, Traj}, c denotes the target objective, and Ci condition evaluated on the i-th perturbed output.
is the target-specific success
Closed-loop. In closed-loop evaluation, each rollout produces a time sequence of outputs, and even benign rollouts can deviate from the reference due to simulator stochasticity and rollout instability. We therefore measure success using excess deviation: the deviation under perturbation minus the deviation already present in the benign rollout. Let {o0t }Tt=1 and {o′t }Tt=1 denote the benign and perturbed output sequences, where ot may be (s,c) reasoning rt or trajectory output τt . For surface s and target c, let Dcl (·, ·) be the closed-loop target-specific deviation function. We define the per-step excess deviation as (s,c)
∆t
(s,c)
= Dcl
(s,c)
(o′t , oref t ) − Dcl
(o0t , oref t ),
where oref t is the aligned reference at time t. This subtraction prevents nominal closed-loop drift or simulator variability from being counted as attack success. Due to closed-loop compounding, small early deviations can accumulate into later failures, so rollout-averaged deviation can understate attack success; conversely, relying on a single time step can overstate success due to transient noise. We therefore define a rollout-level success indicator (s,c) Acl . A closed-loop attack is successful if there exists a contiguous window W of at least w steps for which the average excess deviation exceeds the target-specific threshold: ! 1 X (s,c) (s,c) (s,c) Acl = 1 ∃W ⊆ {1, . . . , T }, |W | ≥ w : ∆t > δcl . |W | t∈W
The closed-loop ASR is then (s,c)
ASRcl
h i (s,c) = E Acl . 6
6
Experiments
6.1
Experimental Setup
6.1.1
Models
We evaluate Alpamayo1 and Alpamayo1.5, NVIDIA’s recent reasoning-enabled autonomous-driving VLAs [44, 32]. Alpamayo1 is trained with supervised learning, while Alpamayo1.5 adds RL posttraining. These models fit our study because they expose explicit, structured reasoning rather than free-form text, tightly couple reasoning with trajectory generation, and provide public datasets and simulation tooling. To our knowledge, no other publicly available industry-developed driving VLA currently offers this combination of structured reasoning outputs, trajectory prediction, and reproducible open-/closed-loop evaluation support. 6.1.2
Dataset & Simulator
For open-loop evaluation, we use 195 samples from the NVIDIA Physical AI Autonomous Vehicles dataset [30], which provides paired visual/textual inputs, reference trajectories, and temporally annotated object bounding boxes. Since the released dataset does not provide reasoning annotations or precomputed safety-critical metrics, we use each model’s default, unperturbed output as the benign reference for reasoning comparisons and derive collision, near-encounter, and time-to-collision metrics from the bounding boxes. For closed-loop evaluation, we use 50 clips from the NVIDIA Physical AI Autonomous Vehicles NuRec dataset [31] and deploy them in AlpaSim [33]. 6.2
Open-Loop Analysis
We first analyze model behavior under open-loop conditions. Table 1 reports the ASR, the average number of queries to success. Table 4 safety metrics as well. ASR is computed over the full dataset, while safety metrics are reported as absolute values with changes (∆) measured relative to outputs from the same model on uncorrupted inputs for the successful attack instances. Reasoning and Trajectory Manipulation. Both models exhibit substantial vulnerability to realistic textual perturbations. For Alpamayo1, semantic reasoning attacks achieve high ASRs across object, relation, implication, and planning targets (0.76–0.89), showing that small perturbations can reliably alter the generated reasoning. Alpamayo1.5 is more robust, with lower but still non-trivial ASRs (0.42–0.63). Structural reasoning attacks are harder, but still succeed in a subset of cases: slowdown occurs more frequently than DoS, which remains rare but observable. Direct trajectory attacks also achieve meaningful success rates and consistently degrade driving behavior, confirming trajectory prediction as the most direct attack surface. Safety Impact. Reasoning manipulation has model-dependent safety effects. For Alpamayo1, successful reasoning attacks often produce inconsistent changes in safety metrics, with both positive and negative ∆ values, suggesting that altered reasoning does not reliably translate into degraded control. In contrast, Alpamayo1.5 shows more consistent safety degradation under successful reasoning attacks, including increased collision rates and reduced minimum TTC across several targets. This suggests that its RL post-training may improve robustness overall, but also be more susceptible to safety-critical failures once this coupling is disrupted. Structural attacks, although less frequent, tend to induce severe degradation when successful, especially for Alpamayo1.5. By comparison, trajectory attacks lead to more stable and pronounced safety degradation across both models, increasing collision and near-encounter rates while reducing minimum TTC. Reasoning–Trajectory Coupling. Figure 3 and 5 further examine the relationship between reasoning manipulation and trajectory deviation under corrupted inputs. Although both surfaces can be manipulated, their correlation remains weak: changes in reasoning do not consistently induce large trajectory deviations, and large trajectory deviations do not necessarily coincide with large reasoning shifts. At the same time, reasoning components remain strongly correlated with each other, indicating that the generated reasoning is internally coherent. This suggests a weak translation from reasoning to control under perturbation, which contrasts with the intended role of reasoning in reasoning-enabled VLA systems. Importantly, weak correlation does not imply low risk: even small trajectory deviations associated with reasoning changes can still compound into safety-critical outcomes. 7
Table 1: Open-loop ASR and query efficiency across reasoning and trajectory targets. Model
Surface
Objective
Target
ASR ↑
Queries ↓
Semantic
Object Relation Implication Planning Overall
0.765 0.889 0.850 0.832 0.836
10.2 6.8 7.6 8.3 9.4
Structural
Slowdown DoS
0.248 0.047
31.9 37.4
Deviation
ADE
0.336
18.6
Semantic
Object Relation Implication Planning Overall
0.436 0.626 0.520 0.429 0.422
10.5 9.8 9.8 10.5 8.9
Structural
Slowdown DoS
0.102 0.088
12.1 15.8
Deviation
ADE
0.115
21.5
Reasoning Alp1
Trajectory
Reasoning Alp1.5
Trajectory
Latency Correlation. Figure 4 shows the strong linear correlation between the number of generated reasoning tokens and latency. This shows that slowdown attacks not only affect the reasoning process but also introduce additional latency overhead in real-time settings such as autonomous driving. 6.3
Closed-Loop Analysis
Attack Effectiveness. Table 2 reports ASR across trajectory and reasoning targets, in the closedloop setting. Trajectory manipulation is the most effective closed-loop attack surface, achieving the highest ASR for both Alpamayo1 (72.0%) and Alpamayo1.5 (48.0%). Reasoning manipulation remains feasible, with semantic attacks reaching 48.0%–62.0% ASR for Alpamayo1 and 40.0%– 44.0% for Alpamayo1.5, indicating reduced but persistent vulnerability under closed-loop interaction. Structural attacks are less effective: slowdown succeeds at modest rates, while DoS is not observed, consistent with the open-loop finding that fully suppressing reasoning is rare. The higher slowdown ASR in Alpamayo1.5 suggests that RL post-training may improve semantic robustness while increasing sensitivity to structural perturbations. Safety Impact. We further analyze the downstream safety impact of successful closed-loop attacks in Appendix B.1. Figures 8 and 9 show that successful perturbations often destabilize model behavior across incident types, typically introducing new safety violations. When the benign rollout is already unsafe, attacks also tend to accelerate failure onset: Table 12 shows that wrong-lane and off-road events occur earlier under perturbation for both models. Finally, Table 11 shows that different manipulated surfaces correlate with different incident types near failure onset; trajectory deviations are more aligned with some events, while reasoning shifts are more prominent for others. This suggests that closed-loop safety degradation is not driven by a single failure channel, but by surfaceand incident-dependent interactions between reasoning, trajectory, and rollout dynamics. 6.4
More Analysis and Ablations
We evaluate the effect of input variations, including semantic changes, augmentation strength, and alternative input channels. With the semantically malicious prompts without textual corruption (Appendix A.2), we observe that both models remain relatively robust to such inputs, largely ignoring malicious intent when the text is clean. Also, when augmentation is being applied to such inputs across different semantic prompt variations, we do not observe considerable changes in ASR or safety metrics compared to the semantically neutral input. As shown in Appendix A.4 and Appendix A.5, stronger augmentations and longer inputs consistently increase ASR, suggesting that both noise level and input surface area amplify attack effectiveness. 8
1.00
Table 2: Closed-loop attack success rates (ASR) across trajectory and reasoning targets.
0.80
0.71
0.86
0.04
relation
0.79
1.00
0.85
0.76
0.92
0.03
impl.
0.80
0.85
1.00
0.86
0.96
0.00
plan
0.71
0.76
0.86
1.00
0.92
0.02
overall
0.86
0.92
0.96
0.92
1.00
0.02
Structural
min ADE
0.04
0.03
0.00
0.02
0.02
1.00
ADE ✗ ✓
0.25 0.50 0.75
ll
DE nA
n pla
ov
era
pl.
Joint density (hexbin, log count)
2.5
102
1.5
log count
Latency (s)
2.0
Reasoning Def
0.25
Figure 3: Alp1: Reasoningtrajectory correlation
Table 3: ASR under baseline (×) and defense (✓). Traj
0.50
mi
0.0 0.0
im
t jec ob
Alp1 0.72 0.48 0.58 0.54 0.62 0.56 0.08 Alp1.5 0.48 0.42 0.44 0.40 0.42 0.40 0.20
0.75
1.00
Dev Obj Rel Impl Plan All Slow DoS
ion
Semantic
0.79
rel at
Traj
1.00
0.00
Reasoning Model
object
1.0
101
0.5
Semantic Obj
Rel
Impl
Structural Plan
All
Slow
0.0
0
10
20
30 Token length
40
50
100
DoS
0.336 0.765 0.889 0.850 0.832 0.836 0.248 0.047 0.142 0.425 0.610 0.426 0.390 0.428 0.038 0.004
Figure 4: Inference latency vs. reasoning length on Alp1.
Alpamayo1.5 additionally accepts navigation (Nav) commands, which provide another pathway for perturbation. As shown in Appendix A.3, Nav-based attacks achieve comparable ASR and induce similar safety degradation, indicating that auxiliary inputs form an additional input attack surface.
7
Mitigation
Despite growing work on VLA attacks, defenses for these systems remain largely unexplored, especially under realistic textual corruptions. We introduce a lightweight input-normalization defense for this setting. Since our attacks preserve intent but corrupt the text surface, a natural defense is to canonicalize the input before it reaches the model. LLM-based correction is undesirable in real-time driving due to latency, while perplexity-based filtering requires threshold selection and discards inputs rather than correcting them [21]. We therefore use a deterministic rule-based normalizer: given t, we construct t̃ by lowercasing, removing non-alphanumeric characters, normalizing whitespace, applying token-level fuzzy correction with a small closed vocabulary, and restoring minimal formatting. This approach is deterministic, efficient, and introduces almost no additional latency. As shown in Table 3, it significantly reduces attack success rates across both trajectory and reasoning surfaces.
8
Discussion and Conclusion
We presented a systematic study of reasoning vulnerabilities in reasoning-enabled VLA models for autonomous driving, along with an evaluation pipeline that links textual perturbations to reasoning changes, trajectory degradation, and downstream safety impact. Our results show that realistic textual perturbations can manipulate semantic and structural reasoning properties, degrade trajectory behavior, and increase safety-critical failures. We further show that reasoning constitutes a distinct attack surface beyond trajectory prediction, and that lightweight input normalization substantially reduces attack success, providing an effective first line of protection against textual corruptions. While our defense mitigates surface-level textual corruptions, it does not address adaptive attacks, semantic perturbations, or attacks in the visual input domain. Future work should develop stronger real-time defenses and study adversaries with partial or full model access, including visual-only and multimodal attacks that jointly target visual and textual inputs. Overall, our results call for systematic robustness evaluation before deploying reasoning-enabled embodied systems. 9
References [1] Saeed S Alahmari, Lawrence Hall, Peter R Mouton, and Dmitry Goldgof. Large language models robustness against perturbation: S. alahmari et al. Scientific Reports, 2025. [2] Mohd Anjum and Sana Shahab. Improving autonomous vehicle controls and quality using natural language processing-based input recognition model. Sustainability, 15(7):5749, 2023. [3] Kevin Black, Noah Brown, Danny Driess, Adnan Esmail, Michael Equi, Chelsea Finn, Niccolo Fusai, Lachy Groom, Karol Hausman, Brian Ichter, et al. π0 : A vision-language-action flow model for general robot control. arXiv preprint arXiv:2410.24164, 2024. [4] Mariusz Bojarski, Davide Del Testa, Daniel Dworakowski, Bernhard Firner, Beat Flepp, Prasoon Goyal, Lawrence D Jackel, Mathew Monfort, Urs Muller, Jiakai Zhang, et al. End to end learning for self-driving cars. arXiv preprint arXiv:1604.07316, 2016. [5] Christine P Chai. Comparison of text preprocessing methods. Natural language engineering, 29(3):509–553, 2023. [6] Mingfei Cheng, Yuan Zhou, Xiaofei Xie, Junjie Wang, Guozhu Meng, and Kairui Yang. Decictor: Towards evaluating the robustness of decision-making in autonomous driving systems. arXiv preprint arXiv:2402.18393, 2024. [7] Kashyap Chitta, Aditya Prakash, Bernhard Jaeger, Zehao Yu, Katrin Renz, and Andreas Geiger. Transfuser: Imitation with transformer-based sensor fusion for autonomous driving. IEEE transactions on pattern analysis and machine intelligence, 45(11):12878–12895, 2022. [8] Felipe Codevilla, Matthias Müller, Antonio López, Vladlen Koltun, and Alexey Dosovitskiy. End-to-end driving via conditional imitation learning. In 2018 IEEE international conference on robotics and automation (ICRA), pages 4693–4700. IEEE, 2018. [9] Felipe Codevilla, Eder Santana, Antonio M López, and Adrien Gaidon. Exploring the limitations of behavior cloning for autonomous driving. In Proceedings of the IEEE/CVF international conference on computer vision, pages 9329–9338, 2019. [10] Tong Cui, Jinghui Xiao, Liangyou Li, Xin Jiang, and Qun Liu. An approach to improve robustness of nlp systems against asr errors. arXiv preprint arXiv:2103.13610, 2021. [11] Yu Cui and Cong Zuo. Practical reasoning interruption attacks on reasoning large language models. arXiv preprint arXiv:2505.06643, 2025. [12] Wenliang Dai, Samuel Cahyawijaya, Tiezheng Yu, Elham J Barezi, Peng Xu, Cheuk Tung Shadow Yiu, Rita Frieske, Holy Lovenia, Genta Indra Winata, Qifeng Chen, et al. Ciavsr: A cantonese audio-visual speech dataset for in-car command recognition. arXiv preprint arXiv:2201.03804, 2022. [13] Miguel Del Río, Corey Miller, Ján Profant, Jennifer Drexler-Fox, Quinn Mcnamara, Nishchal Bhandari, Natalie Delworth, Ilya Pirkin, Migüel Jetté, Shipra Chandra, et al. Accents in speech recognition through the lens of a world englishes evaluation set. Research in Language, 21(3):225–244, 2023. [14] Shengliang Deng, Mi Yan, Songlin Wei, Haixin Ma, Yuxin Yang, Jiayi Chen, Zhiqi Zhang, Taoyu Yang, Xuheng Zhang, Wenhao Zhang, et al. Graspvla: a grasping foundation model pre-trained on billion-scale synthetic action data. arXiv preprint arXiv:2505.03233, 2025. [15] Alexey Dosovitskiy, German Ros, Felipe Codevilla, Antonio Lopez, and Vladlen Koltun. Carla: An open urban driving simulator. In Conference on robot learning, pages 1–16. PMLR, 2017. [16] Bradley Efron. Bootstrap methods: another look at the jackknife. In Breakthroughs in statistics: Methodology and distribution, pages 569–593. Springer, 1992. [17] Esther Gan, Yiran Zhao, Liying Cheng, Mao Yancan, Anirudh Goyal, Kenji Kawaguchi, MinYen Kan, and Michael Shieh. Reasoning robustness of llms to adversarial typographical errors. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 10449–10459, 2024. 10
[18] Kaiser Hamid, Can Cui, and Nade Liang. Icr-drive: Instruction counterfactual robustness for end-to-end language-driven autonomous driving. arXiv preprint arXiv:2604.05378, 2026. [19] Zhengxian Huang, Wenjun Zhu, Haoxuan Qiu, Xiaoyu Ji, and Wenyuan Xu. Trap: Hijacking vla cot-reasoning via adversarial patches. arXiv preprint arXiv:2603.23117, 2026. [20] John Hughes, Sara Price, Aengus Lynch, Rylan Schaeffer, Fazl Barez, Arushi Somani, Sanmi Koyejo, Henry Sleight, Erik Jones, Ethan Perez, et al. Best-of-n jailbreaking. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025. [21] Eliot Krzysztof Jones, Alexander Robey, Andy Zou, Zachary Ravichandran, George J Pappas, Hamed Hassani, Matt Fredrikson, and J Zico Kolter. Adversarial attacks on robotic vision language action models. arXiv preprint arXiv:2506.03350, 2025. [22] Moo Jin Kim, Karl Pertsch, Siddharth Karamcheti, Ted Xiao, Ashwin Balakrishna, Suraj Nair, Rafael Rafailov, Ethan Foster, Grace Lam, Pannag Sanketi, et al. Openvla: An open-source vision-language-action model. arXiv preprint arXiv:2406.09246, 2024. [23] Abhinav Kumar, Jaechul Roh, Ali Naseh, Marzena Karpinska, Mohit Iyyer, Amir Houmansadr, and Eugene Bagdasarian. Overthink: Slowdown attacks on reasoning llms. arXiv preprint arXiv:2502.02542, 2025. [24] Jason Lee, Jiafei Duan, Haoquan Fang, Yuquan Deng, Shuo Liu, Boyang Li, Bohan Fang, Jieyu Zhang, Yi Ru Wang, Sangho Lee, et al. Molmoact: Action reasoning models that can reason in space. arXiv preprint arXiv:2508.07917, 2025. [25] Jiaming Liu, Hao Chen, Pengju An, Zhuoyang Liu, Renrui Zhang, Chenyang Gu, Xiaoqi Li, Ziyu Guo, Sixiang Chen, Mengzhen Liu, et al. Hybridvla: Collaborative diffusion and autoregression in a unified vision-language-action model. arXiv preprint arXiv:2503.10631, 2025. [26] Xiaogeng Liu, Xinyan Wang, Yechao Zhang, Sanjay Kariyappa, Chong Xiang, Muhao Chen, G Edward Suh, and Chaowei Xiao. Reasoningbomb: A stealthy denial-of-service attack by inducing pathologically long reasoning in large reasoning models. arXiv preprint arXiv:2602.00154, 2026. [27] Yihong Liu, Raoyuan Zhao, Lena Altinger, Hinrich Schütze, and Michael A Hedderich. Evaluating robustness of large language models against multilingual typographical errors. arXiv preprint arXiv:2510.09536, 2025. [28] Hui Lu, Yi Yu, Yiming Yang, Chenyu Yi, Qixin Zhang, Bingquan Shen, Alex C Kot, and Xudong Jiang. When robots obey the patch: Universal transferable patch attacks on visionlanguage-action models. arXiv preprint arXiv:2511.21192, 2025. [29] Xuancun Lu, Jiaxiang Chen, Shilin Xiao, Zizhi Jin, Zhangrui Chen, Hanwen Yu, Bohan Qian, Ruochen Zhou, Xiaoyu Ji, and Wenyuan Xu. Phantom menace: Exploring and enhancing the robustness of vla models against physical sensor attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 40, pages 35689–35697, 2026. [30] NVIDIA. Physical ai autonomous vehicles dataset. https://huggingface.co/datasets/ nvidia/PhysicalAI-Autonomous-Vehicles, 2025. Accessed: April 2026. [31] NVIDIA. Physical ai autonomous vehicles nurec dataset. https://huggingface.co/ datasets/nvidia/PhysicalAI-Autonomous-Vehicles-NuRec, 2025. Accessed: April 2026. [32] NVIDIA. Nvidia announces alpamayo family of open-source ai models and tools to accelerate safe, reasoning-based autonomous vehicle development. https://nvidianews.nvidia. com/news/alpamayo-autonomous-vehicle-development, 2026. Accessed: April 2026. [33] NVIDIA, Yulong Cao, Riccardo de Lutio, Sanja Fidler, Guillermo Garcia Cobo, Zan Gojcic, Maximilian Igl, Boris Ivanovic, Peter Karkus, Janick Martinez Esturo, Marco Pavone, Aaron Smith, Ellie Tanimura, Michal Tyszkiewicz, Michael Watson, Qi Wu, and Le Zhang. Alpasim: A modular, lightweight, and data-driven research simulator for autonomous driving, October 2025. 11
[34] Delin Qu, Haoming Song, Qizhi Chen, Yuanqi Yao, Xinyi Ye, Yan Ding, Zhigang Wang, JiaYuan Gu, Bin Zhao, Dong Wang, et al. Spatialvla: Exploring spatial representations for visual-language-action model. arXiv preprint arXiv:2501.15830, 2025. [35] Stéphane Ross, Geoffrey Gordon, and Drew Bagnell. A reduction of imitation learning and structured prediction to no-regret online learning. In Proceedings of the fourteenth international conference on artificial intelligence and statistics, pages 627–635. JMLR Workshop and Conference Proceedings, 2011. [36] Luke Rowe, Rodrigue de Schaetzen, Roger Girgis, Christopher Pal, and Liam Paull. Poutine: Vision-language-trajectory pre-training and reinforcement learning post-training enable robust end-to-end autonomous driving. arXiv preprint arXiv:2506.11234, 2025. [37] Muhammad A Shah, David Solans Noguero, Mikko A Heikkila, Bhiksha Raj, and Nicolas Kourtellis. Speech robust bench: A robustness benchmark for speech recognition. arXiv preprint arXiv:2403.07937, 2024. [38] Wai Man Si, Mingjie Li, Michael Backes, and Yang Zhang. Excessive reasoning attack on reasoning llms. arXiv preprint arXiv:2506.14374, 2025. [39] Kimberly G Smith and Daniel Fogerty. Speech recognition error patterns for steady-state noise and interrupted speech. The Journal of the Acoustical Society of America, 142(3):EL306–EL312, 2017. [40] Rosy Southwell, Samuel Pugh, M Perkoff, Charis Clevenger, Jeffrey Bush, Rachel Lieber, Wayne Ward, Peter Foltz, and Sidney D’Mello. Challenges and feasibility of automatic speech recognition for modeling student collaborative discourse in classrooms. International Educational Data Mining Society, 2022. [41] Lu Wang, Tianyuan Zhang, Yang Qu, Siyuan Liang, Yuwei Chen, Aishan Liu, Xianglong Liu, and Dacheng Tao. Black-box adversarial attack on vision language models for autonomous driving. arXiv preprint arXiv:2501.13563, 2025. [42] Taowen Wang, Cheng Han, James Liang, Wenhao Yang, Dongfang Liu, Luna Xinyu Zhang, Qifan Wang, Jiebo Luo, and Ruixiang Tang. Exploring the adversarial vulnerabilities of visionlanguage-action models in robotics. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 6948–6958, 2025. [43] Xin Wang, Jie Li, Zejia Weng, Yixu Wang, Yifeng Gao, Tianyu Pang, Chao Du, Yan Teng, Yingchun Wang, Zuxuan Wu, et al. Freezevla: Action-freezing attacks against vision-languageaction models. arXiv preprint arXiv:2509.19870, 2025. [44] Yan Wang, Wenjie Luo, Junjie Bai, Yulong Cao, Tong Che, Ke Chen, Yuxiao Chen, Jenna Diamond, Yifan Ding, Wenhao Ding, et al. Alpamayo-r1: Bridging reasoning and action prediction for generalizable autonomous driving in the long tail. arXiv preprint arXiv:2511.00088, 2025. [45] Yiru Wang, Zichong Gu, Yu Gao, Anqing Jiang, Zhigang Sun, Shuo Wang, Yuwen Heng, and Hao Sun. Hist-vla: A hierarchical spatio-temporal vision-language-action model for end-to-end autonomous driving. arXiv preprint arXiv:2602.13329, 2026. [46] Junjie Wen, Yichen Zhu, Jinming Li, Minjie Zhu, Zhibin Tang, Kun Wu, Zhiyuan Xu, Ning Liu, Ran Cheng, Chaomin Shen, et al. Tinyvla: Towards fast, data-efficient vision-language-action models for robotic manipulation. IEEE Robotics and Automation Letters, 2025. [47] Fuliang Weng, Pongtep Angkititrakul, Elizabeth E Shriberg, Larry Heck, Stanley Peters, and John HL Hansen. Conversational in-vehicle dialog systems: The past, present, and future. IEEE Signal Processing Magazine, 33(6):49–60, 2016. [48] Xiyang Wu, Guangyao Shi, Qingzi Wang, Zongxia Li, Amrit Singh Bedi, and Dinesh Manocha. Saber: A stealthy agentic black-box attack framework for vision-language-action models. arXiv preprint arXiv:2603.24935, 2026. 12
[49] Haochuan Xu, Yun Sing Koh, Shuhuai Huang, Zirun Zhou, Di Wang, Jun Sakuma, and Jingfeng Zhang. Model-agnostic adversarial attack and defense for vision-language-action models. arXiv preprint arXiv:2510.13237, 2025. [50] Yuping Yan, Yuhan Xie, Yixin Zhang, Lingjuan Lyu, Handing Wang, and Yaochu Jin. When alignment fails: Multimodal adversarial attacks on vision-language-action models. arXiv preprint arXiv:2511.16203, 2025. [51] Shuai Yang, Hao Li, Bin Wang, Yilun Chen, Yang Tian, Tai Wang, Hanqing Wang, Feng Zhao, Yiyi Liao, and Jiangmiao Pang. Instructvla: Vision-language-action instruction tuning from understanding to manipulation. arXiv preprint arXiv:2507.17520, 2025. [52] Naifu Zhang, Wei Tao, Xi Xiao, Qianpu Sun, Yuxin Zheng, Wentao Mo, Peiqiang Wang, and Nan Zhang. Attention-guided patch-wise sparse adversarial attacks on vision-language-action models. arXiv preprint arXiv:2511.21663, 2025. [53] Tianyuan Zhang, Lu Wang, Xinwei Zhang, Yitong Zhang, Boyi Jia, Siyuan Liang, Shengshan Hu, Qiang Fu, Aishan Liu, and Xianglong Liu. Visual adversarial attack on vision-language models for autonomous driving. arXiv preprint arXiv:2411.18275, 2024. [54] X. Zhou, X. Han, F. Yang, Y. Ma, V. Tresp, and A. Knoll. Opendrivevla: Towards end-to-end autonomous driving with large vision language action model. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 40, pages 13782–13790, 2026. [55] Xueyang Zhou, Guiyao Tie, Guowen Zhang, Hechang Wang, Pan Zhou, and Lichao Sun. Badvla: Towards backdoor attacks on vision-language-action models via objective-decoupled optimization. arXiv preprint arXiv:2505.16640, 2025. [56] Zewei Zhou, Tianhui Cai, Seth Z Zhao, Yun Zhang, Zhiyu Huang, Bolei Zhou, and Jiaqi Ma. Autovla: A vision-language-action model for end-to-end autonomous driving with adaptive reasoning and reinforcement fine-tuning. arXiv preprint arXiv:2506.13757, 2025.
13
Table 4: Open-loop ASR and downstream safety impact across reasoning and trajectory targets. Model Surface
Safety Metrics (abs. (∆))
ASR ↑ Queries ↓
Objective Target
Coll. (%) ↑
N.-Enc. (%) ↑ TTC (ms) ↓
Semantic
Object Relation Implication Planning Overall
0.765 0.889 0.850 0.832 0.836
10.2 6.8 7.6 8.3 9.4
8.45 (-0.53) 7.29 (-0.79) 7.84 (-0.60) 6.90 (-1.36) 7.74 (-0.85)
67.43 (0.14) 66.55 (0.35) 68.76 (0.48) 65.48 (0.62) 68.10 (0.37)
950 (-36) 960 (-13) 929 (-7) 999 (-27) 945 (-5)
Structural
Slowdown DoS
0.248 0.047
31.9 37.4
6.69 (-2.40) 8.89 (2.22)
72.31 (-0.87) 69.56 (-10.89)
989 (-125) 492 (101)
Reasoning Alp1
Trajectory Deviation
ADE
0.336
18.6
15.56 (5.81)
65.55 (4.57)
1091 (-145)
Semantic
Object Relation Implication Planning Overall
0.436 0.626 0.520 0.429 0.422
10.5 9.8 9.8 10.5 8.9
6.12 (1.41) 4.92 (0.00) 7.11 (0.99) 4.78 (1.19) 4.87 (0.00)
69.91 (0.01) 72.31 (1.49) 75.55 (0.79) 71.06 (-0.73) 71.55 (0.02)
953 (-87) 802 (-29) 716 (-44) 822 (-38) 737 (-54)
Structural
Slowdown DoS
0.102 0.088
12.1 15.8
10.12 (5.06) 11.58 (5.75)
63.64 (0.00) 76.84 (1.11)
962 (-72) 653 (-17)
ADE
0.115
21.5
10.68 (10.68)
74.16 (9.70)
1678 (-132)
Reasoning Alp1.5
Trajectory Deviation
1.00 object
1.00
0.84
0.85
0.83
0.93
0.01
relation
0.84
1.00
0.87
0.81
0.93
0.02
impl.
0.85
0.87
1.00
0.90
0.96
0.02
plan
0.83
0.81
0.90
1.00
0.94
0.01
overall
0.93
0.93
0.96
0.94
1.00
0.01
min ADE
0.01
0.02
0.02
0.01
0.01
1.00
0.75 0.50 0.25 0.00 0.25 0.50 0.75
DE nA mi
ll ov
era
n pla
pl. im
n tio rel a
ob
jec
t
1.00
Figure 5: Alp1.5: Reasoning-trajectory correlation
A
Extended Open-Loop Results
A.1
Effect of Query Budget and Threshold
We further analyze how the query budget and success threshold affect attack success in the open-loop setting. Figures 6 and 7 report ASR as a function of the number of perturbation queries N for Alpamayo1 and Alpamayo1.5, respectively, across semantic reasoning, structural reasoning, and trajectory objectives. Unless otherwise stated, our main open-loop experiments use N = 100 as the default query budget, δtraj = 1 for trajectory manipulation based on min-ADE, and a 100% token increase threshold for slowdown, i.e., the perturbed reasoning must be at least twice as long as the benign reasoning. We choose N = 100 because it provides a practical trade-off: it is not an excessively large query budget, yet it achieves substantial ASR and lies near the saturation region of most curves. For trajectory manipulation, we use a 1m min-ADE threshold because it captures physically meaningful trajectory deviation while still yielding measurable attack success. For slowdown, we use the stricter 100% token-increase threshold to test whether perturbations can substantially push the model into longer reasoning generation. 14
ASR vs query budget N (coc decomposition)
ASR vs query budget N (coc token length)
Decomposition type object relation implication 0.8 planning overall 0.9
0.8 0.6 ASR
0.7 ASR
Condition freeze (zero token output) token increase =10.0% token increase =25.0% token increase =50.0% token increase =75.0% token increase =100%
0.6
0.4
0.5 0.2
0.4 0.3
0.0 100
101
102
N
103
101
100
(a) Target: CoC Semantic Decomposition
N
102
103
(b) Target: CoC Token Length
ASR vs query budget N (trajectory: min ADE) abs minADE 0.2 abs minADE 0.5 abs minADE 1 abs minADE 2 abs minADE 5 rel minADE (1+0.1)× benign rel minADE (1+0.2)× benign rel minADE (1+0.5)× benign rel minADE (1+0.7)× benign rel minADE (1+0.9)× benign rel minADE (1+1)× benign
0.8
ASR
0.6 0.4 0.2 0.0 101
100
N
102
103
(c) Target: Trajectory Prediction
Figure 6: Alpamayo1 open-loop ASR under varying query budgets and success thresholds across reasoning and trajectory objectives.
Across both models, ASR increases monotonically with the query budget, showing that the perturbation space contains many successful variants that become easier to discover as more queries are allowed. This trend is strongest for semantic reasoning objectives: object, relation, implication, planning, and overall reasoning deviation all improve steadily with larger N . Alpamayo1 is consistently more vulnerable than Alpamayo1.5, reaching higher ASR under the same query budget, which is consistent with the stronger robustness of Alpamayo1.5 observed in the main results. Threshold choice also has a substantial effect on the measured ASR. For structural reasoning attacks, lower token-increase thresholds yield higher success rates, while stricter slowdown criteria reduce ASR but remain non-negligible at larger query budgets. The freeze/zero-token condition remains the hardest structural objective, indicating that fully suppressing reasoning is substantially more difficult than increasing reasoning length. For trajectory attacks, smaller absolute or relative min-ADE thresholds produce higher ASR, while stricter thresholds require larger query budgets and remain harder to satisfy. This confirms that textual perturbations often induce measurable trajectory drift, but large trajectory deviations require either more favorable perturbations or a larger query budget. Overall, these results show that attack success is not an artifact of a single threshold choice. Instead, both reasoning and trajectory vulnerabilities persist across a range of thresholds, with ASR increasing smoothly as the adversary is allowed more queries. At the same time, the results highlight the importance of reporting query budgets and thresholds explicitly: overly permissive thresholds can overstate practical risk, while overly strict thresholds may hide smaller deviations that can still compound in closed-loop driving. A.2
Malicious vs. Neutral Inputs
We further compare semantically neutral inputs with semantically malicious inputs to separate the effect of malicious intent from the effect of textual corruption. Table 5 reports results for clean malicious prompts without augmentation (N = 0). Across different semantic intents and prompt types, clean malicious prompts produce only small deviations in reasoning and do not substantially change the trajectory error compared to the neutral input, even slightly decreasing it. This suggests that the model is relatively robust to explicit malicious semantics when the input is well-formed: the model often ignores the malicious instruction rather than directly following it. 15
ASR vs query budget N (coc decomposition)
ASR vs query budget N (coc token length)
0.7 Decomposition type object relation implication 0.6 planning overall
Condition freeze (zero token output) token increase =10.0% token increase =25.0% token increase =50.0% token increase =75.0% token increase =100%
0.5 0.4 ASR
ASR
0.5 0.3
0.4 0.2 0.3 0.1 0.2 101
100
102
N
103
101
100
(a) Target: CoC Semantic Decomposition
102
N
103
(b) Target: CoC Token Length
ASR vs query budget N (trajectory: min ADE) abs minADE 0.2 abs minADE 0.5 abs minADE 1 abs minADE 2 abs minADE 5 rel minADE (1+0.1)× benign rel minADE (1+0.2)× benign rel minADE (1+0.5)× benign rel minADE (1+0.7)× benign rel minADE (1+0.9)× benign rel minADE (1+1)× benign
0.8
ASR
0.6
0.4
0.2
0.0 100
101
N
102
103
(c) Target: Trajectory Prediction
Figure 7: Alpamayo1.5 open-loop ASR under varying query budgets and success thresholds across reasoning and trajectory objectives. Table 5: Effect of clean malicious prompts without textual augmentation. Results compare neutral inputs against malicious prompts with different semantic intents and prompt types at N = 0. Trajectory Prompt Semantic Neutral
Intent
Type
Reasoning Semantic
min ADE Object
Relation
Impl.
Planning
Overall
–
–
0.93
–
–
–
–
–
Object
Obvious Plausible
0.84 0.86
0.11 0.09
0.16 0.15
0.15 0.15
0.10 0.08
0.14 0.12
Relation
Obvious Plausible
0.87 0.88
0.09 0.09
0.15 0.17
0.14 0.16
0.08 0.09
0.12 0.14
Impl.
Obvious Plausible
0.86 0.86
0.10 0.11
0.16 0.18
0.15 0.16
0.09 0.10
0.13 0.14
Planning
Obvious Plausible
0.86 0.85
0.10 0.13
0.16 0.17
0.15 0.15
0.08 0.10
0.12 0.14
Overall
Obvious Plausible
0.87 0.86
0.10 0.14
0.16 0.19
0.16 0.15
0.10 0.11
0.13 0.15
Malicious
However, once realistic textual corruptions are applied, the difference between neutral and malicious inputs becomes small. As shown in Table 6, attacks starting from malicious inputs achieve ASR values comparable to those starting from neutral inputs across trajectory, semantic reasoning, and structural reasoning objectives. For example, trajectory ASR changes only slightly, while semantic reasoning ASR remains in a similar range across object, relation, implication, planning, and overall targets. Structural attacks also show only modest differences, with slowdown and DoS remaining harder than semantic reasoning manipulation. Table 7 further breaks down malicious inputs by semantic intent and prompt type. The results show no single malicious intent or prompt type consistently dominates across all objectives. Obvious and 16
Table 6: Attack success rates for neutral versus malicious inputs under textual augmentation. ASR is reported across trajectory, semantic reasoning, and structural reasoning objectives. Prompt Surface Semantic
Objective Target
Safety Metrics (abs. (∆))
ASR ↑ Queries ↓
Coll. (%) ↑
N.-Enc. (%) ↑ TTC (ms) ↓
Semantic
Object Relation Implication Planning Overall
0.765 0.889 0.850 0.832 0.836
10.2 6.8 7.6 8.3 9.4
8.45 (-0.53) 7.29 (-0.79) 7.84 (-0.60) 6.90 (-1.36) 7.74 (-0.85)
67.43 (0.14) 66.55 (0.35) 68.76 (0.48) 65.48 (0.62) 68.10 (0.37)
950 (-36) 960 (-13) 929 (-7) 999 (-27) 945 (-5)
Structural
Slowdown DoS
0.248 0.047
31.9 37.4
6.69 (-2.40) 72.31 (-0.87) 8.89 (2.22) 69.56 (-10.89)
989 (-125) 492 (101)
ADE
0.336
18.6
15.56 (5.81)
65.55 (4.57)
1091 (-145)
Semantic
Object Relation Implication Planning Overall
0.772 0.896 0.866 0.829 0.818
9.26 6.85 7.96 8.083 7.863
9.43 (0.13) 7.89 (-0.12) 6.64 (-1.65) 6.93 (-1.36) 8.40 (-0.38)
69.06 (0.93) 67.51 (1.03) 68.13 (0.12) 67.70 (0.62) 68.04 (0.50)
1009 (12) 1038 (5) 1020 (30) 1035 (52) 1042 (27)
Structural
Slowdown DoS
0.297 0.058
32.97 42.70
9.64 (-1.37) 7.62 (-7.91)
73.78 (-2.72) 69.02 (-9.44)
817 (-161) 1376 (-2)
ADE
0.35
19.29
16.97 (7.00)
65.65 (3.82)
1107 (-42)
Reasoning Neutral
Trajectory Deviation
Reasoning Malicious
Trajectory Deviation
Table 7: ASR by malicious prompt semantic intent and prompt type across trajectory, semantic reasoning, and structural objectives. Reasoning Intent
Type
Trajectory
Semantic
Structural
ADE
Object Relation Impl. Planning Overall Slowdown
DoS
Object
Obvious Plausible
0.376 0.384
0.770 0.782
0.892 0.889
0.874 0.862
0.855 0.836
0.838 0.848
0.292 0.268
0.054 0.058
Relation
Obvious Plausible
0.353 0.352
0.762 0.775
0.867 0.889
0.853 0.857
0.837 0.847
0.817 0.839
0.285 0.243
0.041 0.064
Impl.
Obvious Plausible
0.363 0.362
0.776 0.760
0.902 0.894
0.870 0.838
0.844 0.835
0.837 0.817
0.313 0.271
0.069 0.054
Planning
Obvious Plausible
0.344 0.367
0.790 0.824
0.897 0.906
0.871 0.824
0.828 0.829
0.835 0.831
0.262 0.259
0.053 0.056
Universal
Obvious Plausible
0.350 0.356
0.772 0.821
0.896 0.892
0.866 0.812
0.829 0.840
0.818 0.825
0.297 0.258
0.058 0.068
plausible malicious variants lead to similar ASR values, and the differences across object-, relation-, implication-, planning-, and universal-intent prompts are relatively small. Therefore, the attack effectiveness is not primarily driven by a specific malicious instruction template. A.3
Effect of Navigation Commands
Alpamayo1.5 additionally accepts navigation commands as part of its textual input, providing another potential input channel for perturbation. We therefore evaluate whether perturbing this auxiliary navigation input leads to vulnerabilities similar to those observed for the main textual input. Table 8 reports the corresponding ASR and safety impact across trajectory, semantic reasoning, and structural reasoning objectives. The results show that navigation commands are also vulnerable to realistic textual perturbations. Nav-based attacks achieve non-trivial ASR across both reasoning and trajectory objectives, indicating that the model does not rely only on the primary instruction channel when forming its reasoning and 17
Table 8: Effect of perturbing Alpamayo1.5 navigation commands. ASR is reported across trajectory, semantic reasoning, and structural reasoning objectives; safety metrics are reported on successful attacks. Prompt Surface Type
Sys & User
Objective Target
ASR ↑ Queries ↓
Safety Metrics (abs. (∆)) Coll. (%) ↑
N.-Enc. (%) ↑ TTC (ms) ↓
Semantic
Object Relation Implication Planning Overall
0.436 0.626 0.520 0.429 0.422
10.5 9.8 9.8 10.5 8.9
6.12 (1.41) 4.92 (0.00) 7.11 (0.99) 4.78 (1.19) 4.87 (0.00)
69.91 (0.01) 72.31 (1.49) 75.55 (0.79) 71.06 (-0.73) 71.55 (0.02)
953 (-87) 802 (-29) 716 (-44) 822 (-38) 737 (-54)
Structural
Slowdown DoS
0.102 0.088
12.1 15.8
10.12 (5.06) 11.58 (5.75)
63.64 (0.00) 76.84 (1.11)
962 (-72) 653 (-17)
Reasoning
Trajectory Deviation
ADE
0.115
21.5
10.68 (10.68)
74.16 (9.70)
1678 (-132)
Semantic
Object Relation Implication Planning Overall
0.400 0.427 0.375 0.381 0.363
11.8 11.7 12.90 11.32 10.44
6.67 (1.54) 7.46 (1.45) 6.01 (0.54) 5.12 (-0.27) 6.78 (1.13)
74.89 (2.05) 75.73 (0.97) 75.68 (0.26) 69.27 (0.26) 74.00 (0.83)
786 (35) 749 (54) 735 (81) 885 (75) 836 (68)
Structural
Slowdown DoS
0.105 0.023
19.85 36.1
18.67 (3.95) 0.00 (0.00)
86.29 (-3.90) 91.00 (14.00)
412 (-40) 1006 (-371)
ADE
0.124
12.65
8.27 (8.27)
78.53 (4.97)
1098 (-134)
Reasoning Nav
Trajectory Deviation
trajectory outputs. In particular, perturbations to navigation commands can alter semantic reasoning components and induce trajectory deviations, showing that auxiliary textual inputs can propagate through both output surfaces. The resulting safety impact is also comparable to the trends observed for the main textual input. Successful navigation-command attacks can increase collision and near-encounter rates and reduce min-TTC, suggesting that perturbing this auxiliary channel can still lead to safety-relevant degradation. Overall, Table 8 shows that vulnerabilities are not limited to a single textual field. For Alpamayo1.5, both the main textual input and navigation commands can be exploited through realistic surface-form corruptions. A.4
Effect of Augmentation Strength
We analyze how perturbation intensity affects attack success by varying the augmentation strength σ. Following prior work, we use σ = 0.4 as the default setting in our main experiments, as it provides a practical middle ground: it is strong enough to reveal model vulnerabilities, but not so aggressive that it destroys the readability or intended meaning of the input text. As shown in Table 9, ASR generally increases with larger σ across trajectory, semantic reasoning, and structural reasoning objectives. However, even mild perturbations remain effective, with σ = 0.1 already producing substantial semantic reasoning ASR. This indicates that the observed vulnerabilities are not only an artifact of extreme textual corruption, while stronger perturbations naturally expose a larger attack surface. A.5
Effect of Input Token Length
We further study whether longer textual inputs increase vulnerability under perturbation. In our main experiments, we use 29 tokens because this matches the default prompt length used by the evaluated models. Table 10 shows that ASR increases substantially as input length grows from 12 to 51 tokens, especially for trajectory deviation and semantic reasoning manipulation. This suggests that longer inputs provide a larger perturbable surface: even when each individual corruption is small, more tokens create more opportunities for perturbations to affect the model output. Structural attacks show a weaker but still generally increasing trend, with DoS becoming more frequent for longer inputs. 18
Table 9: Effect of augmentation strength on open-loop ASR. Larger σ corresponds to stronger textual perturbations. Reasoning σ
Trajectory
0.1 0.25 0.4 0.7
Semantic
Structural
ADE
Object
Relation
Impl.
Planning
Overall
Slowdown
DoS
0.248 0.309 0.336 0.392
0.664 0.764 0.765 0.851
0.814 0.889 0.889 0.953
0.656 0.781 0.850 0.882
0.690 0.770 0.832 0.856
0.687 0.772 0.836 0.867
0.137 0.202 0.248 0.317
0.011 0.031 0.047 0.069
Table 10: Effect of input token length on open-loop ASR. Longer textual inputs provide a larger perturbable surface and generally increase vulnerability. Reasoning Token Length
Trajectory
12 29 51
Semantic
Structural
ADE
Object
Relation
Impl.
Planning
Overall
Slowdown
DoS
0.154 0.336 0.530
0.521 0.765 0.891
0.679 0.889 0.955
0.507 0.850 0.906
0.484 0.832 0.865
0.510 0.836 0.905
0.135 0.248 0.227
0.017 0.047 0.073
B
Extended Closed-Loop Analysis
B.1
Safety Impact
We further analyze the downstream safety impact of successful closed-loop attacks. Figures 8 and 9 compare the incident rates of benign and perturbed rollouts for trajectory- and reasoning-targeted attacks, respectively. Overall, corrupted textual inputs make model behavior less stable: perturbations often push the rollout away from its nominal behavior, and these deviations can introduce new safety violations such as collisions, off-road events, or wrong-lane driving. For Alpamayo1, this instability leads to clear safety degradation. In particular, successful perturbations increase the number of collision incidents by several cases, with approximately three to four additional collisions depending on the attack surface. The effect is not uniform across all incident types, however. When the benign rollout is already unsafe, perturbations may occasionally move the vehicle away from the original failure mode and reduce a particular incident. Such cases should not be interpreted as attack improvement; rather, they reflect the high sensitivity of closed-loop driving dynamics, where deviations from an already unstable trajectory can sometimes mask one failure while introducing or shifting another. Alpamayo1.5 is relatively more robust, consistent with the lower closed-loop ASR reported in the main results. Nevertheless, it remains vulnerable: successful perturbations still induce non-trivial safety changes and can destabilize rollout behavior. A notable observation is that Alpamayo1.5 already exhibits a high off-road rate under benign execution. Because the nominal behavior is itself unstable for this metric, some perturbations reduce off-road incidents relative to the benign rollout. This does not imply robustness or safety improvement under attack; instead, it shows that off-road behavior is dominated by a weak benign baseline in these scenarios, making the measured attack effect less clean than for collision or wrong-lane incidents. Taken together, Figures 8 and 9 show that closed-loop safety impact is incident- and model-dependent. Corrupted inputs generally destabilize the model and often introduce new failures, especially for Alpamayo1, while in cases where the benign model already fails, perturbations can occasionally alter the failure mode or reduce a specific incident count. This reinforces the need to evaluate attacks in closed loop: the safety consequence of a reasoning or trajectory deviation cannot be fully captured by open-loop error alone. 19
incident
3
both safe
introduced
1
0
removed
both unsafe
no incident
incident
no incident incident Malicious
Benign
no incident
incident
Collision (N=24)
24
0
both safe
introduced
0
0
removed
both unsafe
26
1
both safe
introduced
0
9
removed
both unsafe
Alpamayo1
no incident
incident
no incident incident Malicious
Alpamayo1.5 no incident
Benign
Alpamayo1.5
Wrong Lane (N=36)
Benign
32
Alpamayo1
incident
no incident incident Malicious
Wrong Lane (N=24)
17
0
both safe
introduced
0
7
removed
both unsafe
Offroad (N=36)
24
6
both safe
introduced
1
5
removed
both unsafe
no incident incident Malicious
Alpamayo1.5
no incident Benign
Benign
no incident
Collision (N=36)
Benign
Alpamayo1
incident
no incident incident Malicious
Offroad (N=24)
15
1
both safe
introduced
3
5
removed
both unsafe
no incident incident Malicious
Figure 8: Closed-loop safety impact of successful trajectory-targeted attacks. Bars compare benign and perturbed rollouts across collision, off-road, and wrong-lane incidents for Alpamayo1 and Alpamayo1.5.
incident
4
both safe
introduced
1
0
removed
both unsafe
no incident
incident
no incident incident Malicious
Benign
no incident
incident
Collision (N=39)
39
0
both safe
introduced
0
0
removed
both unsafe
no incident incident Malicious
28
1
both safe
introduced
1
13
removed
both unsafe
Alpamayo1
no incident
incident
no incident incident Malicious
Alpamayo1.5 no incident
Benign
Alpamayo1.5
Wrong Lane (N=43)
Benign
38
Alpamayo1
incident
Wrong Lane (N=39)
25
2
both safe
introduced
0
12
removed
both unsafe
no incident incident Malicious
Offroad (N=43)
28
5
both safe
introduced
2
8
removed
both unsafe
no incident incident Malicious
Alpamayo1.5
no incident Benign
Benign
no incident
Collision (N=43)
Benign
Alpamayo1
incident
Offroad (N=39)
24
1
both safe
introduced
5
9
removed
both unsafe
no incident incident Malicious
Figure 9: Closed-loop safety impact of successful reasoning-targeted attacks. Bars compare benign and perturbed rollouts across collision, off-road, and wrong-lane incidents for Alpamayo1 and Alpamayo1.5.
20
Table 11: Trajectory and reasoning deviations measured before closed-loop incident onset. Model
B.2
Incident
Deviation
N. Clips
ASR
Trajectory
Reasoning
Trajectory
Reasoning
Alpamayo1
Collision Wrong Lane Off-road
4 1 6
0.67 1.12 0.03
0.39 0.04 0.51
50 100 0
50 0 50
Alpamayo1.5
Collision Wrong Lane Off-road
0 2 2
-2.12 -0.80
0.53 -0.35
0 0
50 0
Pre-Incident Behavior Analysis
To better understand how closed-loop failures emerge, we analyze model behavior in a short temporal window before each safety incident. Table 11 reports the average trajectory deviation and reasoning deviation measured immediately before collision, wrong-lane, and off-road events. This analysis complements the scenario-level safety results in Appendix B.1 by examining which output surface changes most strongly near failure onset. The results show that closed-loop incidents are not associated with a single uniform failure channel. For some incident types, trajectory deviation is more prominent before failure, suggesting that corrupted inputs directly destabilize the realized ego motion. For other incidents, reasoning deviation is more pronounced, indicating that the model’s intermediate reasoning can shift substantially near unsafe behavior even when trajectory deviation alone does not fully explain the event. This supports our broader observation that reasoning and trajectory interact in an incident-dependent manner under closed-loop dynamics. Importantly, this analysis should not be interpreted as establishing causal attribution. Because closedloop rollouts are dynamic and compounding, a perturbation may first affect reasoning, trajectory, or both, and later deviations can be amplified by simulator feedback. Therefore, Table 11 should be viewed as a diagnostic analysis of pre-incident behavior rather than a definitive explanation of why each incident occurs. Nevertheless, the results show that successful attacks often produce measurable deviations before safety violations, reinforcing that corrupted textual inputs can destabilize both intermediate reasoning and downstream control. B.3
Timing
We analyze when safety incidents first occur during closed-loop rollouts. Table 12 reports the average first time step of each incident type under benign and perturbed executions, where smaller values indicate earlier failure onset. The results show that corrupted inputs can shift failures earlier in the rollout, especially for wrong-lane and off-road incidents. This suggests that perturbations do not only change whether a failure occurs, but can also accelerate the emergence of unsafe behavior. The effect is stronger for Alpamayo1, consistent with its higher closed-loop vulnerability, while Alpamayo1.5 remains relatively more stable but not immune. These timing results should be interpreted together with the benign incident rates. When the benign rollout is already unstable, perturbations may sometimes delay or alter a specific incident type rather than uniformly making all failures earlier. Overall, Table 12 shows that corrupted inputs affect both the occurrence and temporal onset of closed-loop failures. B.4
Different Window Size and Threshold
We evaluate the sensitivity of closed-loop ASR to the temporal consistency requirement k and the deviation threshold ϵ. For trajectory deviation, Table 13 shows that ASR is stable across moderate values of k: for both models, increasing k from 1 to 5 changes ASR only slightly. This suggests that successful trajectory attacks are not dominated by isolated one-step spikes, but often persist 21
Table 12: Average first occurrence time step of closed-loop incidents under benign and perturbed rollouts. Avg Second in Benign
Avg Second in Malicious
∆ (s)
Collision Wrong Lane Off-road
6.31 7.43
5.72 6.12
-0.59 -1.31
Collision Wrong Lane Off-road
6.11 5.85
5.57 5.42
-0.54 -0.43
Model
Incident
Alpamayo 1
Alpamayo 1.5
Table 13: Closed-loop trajectory ASR sensitivity to temporal consistency k and deviation threshold ϵ. ASR requires the excess deviation Da (t) − Db (t) to exceed ϵ for at least k+1 consecutive steps. Model Alpamayo1 Alpamayo1.5
Temporal Consistency (ϵ = 0.5m)
Deviation Threshold (k = 3)
k=0
k=1
k=2
k=3
k=5
k=10
0.5m
1.0m
1.5m
2.0m
3.0m
76.0 50.0
72.0 50.0
72.0 48.0
72.0 48.0
72.0 46.0
68.0 40.0
72.0 48.0
58.0 34.0
50.0 30.0
44.0 26.0
32.0 20.0
over multiple consecutive steps. We therefore use k = 3 as the default setting, which requires the deviation to persist for at least four consecutive steps. This filters transient noise while avoiding an overly strict criterion that would miss short but safety-relevant deviations in closed-loop driving. The deviation threshold has a stronger effect. As expected, increasing ϵ reduces ASR, since larger excess trajectory deviations are harder to induce. We use ϵ = 0.5 m as the default closed-loop threshold because it captures meaningful deviation in realized ego motion while still preserving enough sensitivity to detect early closed-loop drift before it compounds into larger failures. Stricter thresholds such as 1.0–3.0 m remain useful for measuring more severe deviations, but they undercount smaller perturbation-induced changes that can still become safety-relevant over time. Table 14 reports the same temporal-consistency analysis for reasoning objectives. Semantic reasoning ASR decreases gradually as k increases, but remains substantial even under stricter windows, indicating that reasoning shifts are often temporally persistent. In contrast, slowdown ASR drops much faster with larger k, especially for Alpamayo1, suggesting that reasoning-length expansion is more intermittent than semantic drift. Overall, these results support our default closed-loop choice of k = 3: it is strict enough to avoid counting transient fluctuations, but not so strict that it removes meaningful closed-loop deviations.
22
Table 14: Closed-loop reasoning ASR sensitivity to temporal consistency k. Semantic deviation uses ϵ = 0.5, while slowdown uses a 25% excess token-length threshold after subtracting benign variation. Model
Alpamayo1
Alpamayo1.5
ASR across k (%)
Metric k=0
k=1
k=2
k=3
k=5
k=7
k=10
Object Relation Implication Planning Overall
98.0 98.0 98.0 98.0 98.0
92.0 98.0 92.0 96.0 92.0
86.0 90.0 88.0 94.0 88.0
78.0 86.0 82.0 90.0 86.0
74.0 82.0 76.0 86.0 74.0
62.0 74.0 62.0 78.0 60.0
52.0 48.0 48.0 58.0 50.0
Slowdown
44.0
22.0
10.0
8.0
4.0
0.0
0.0
Object Relation Implication Planning Overall
90.0 92.0 90.0 92.0 90.0
88.0 92.0 86.0 88.0 86.0
84.0 84.0 80.0 80.0 78.0
82.0 82.0 76.0 80.0 78.0
64.0 66.0 58.0 66.0 64.0
54.0 54.0 56.0 56.0 56.0
52.0 50.0 48.0 40.0 50.0
Slowdown
38.0
30.0
24.0
20.0
12.0
10.0
4.0
23