mlsanityData to 7 Oct 2026

Reasoning as a Double-Edged Sword: Architecture and Cross-Stage Robustness in Vision-Language-Action Models

arXiv 2607.17786 ↗First posted 20 Jul 2026cs.RO cs.AI cs.CRcited by 0

On the map: LLM reasoning → Spatial and embodied reasoning

also in 1 more
Abstract (arXiv)

Does adding a reasoning step make a Vision-Language-Action (VLA) model more robust to perturbation? Intuitively, a policy that reasons before acting should absorb a perturbed input better than one that maps observations directly to actions. We test this premise head-on across three models that span the reasoning spectrum (no reasoning, a text chain-of-thought, and a latent iterative loop), perturbing each at the vision, reasoning, and action stages on LIBERO and SimplerEnv. Two questions organize the study: does the reasoning design shift robustness, and can the reasoning be read back at runtime as a safety signal? We find that the latent-iterative model is by far the least robust: under both stochastic noise and white-box perturbation its task success collapses, while the other two hold. This fragility is structural rather than cumulative: varying the reasoning depth at inference barely moves it. Reasoning outputs can in principle be monitored, but the monitors fail under fair tests. A plan--action consistency probe that looks near-perfect under naive evaluation falls to chance under adaptive attack. Under matched-FPR calibration, fusing it with an action-anomaly probe never lifts defended success above undefended. Scoped to these output-level behavioral probes under white-box vision-stage attack, this ceiling is a precondition that any viable defense must first satisfy.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Spatial and embodied reasoning, one of 17 directions in LLM reasoning. Builds on 63 of its 71 references that are in the map. First posted on arXiv 20 Jul 2026.

Builds on

63 of 71 references.

Closest ancestors · 8

Same direction, newest first

  1. 2026TRAP: Hijacking VLA CoT-Reasoning via Adversarial Patches24 Mar
  2. 2026Recurrent-Depth VLA: Implicit Test-Time Compute Scaling of Vision-Language-Action Models via Latent Iterative Reasoning8 Feb
  3. 2025DeepThinkVLA: Enhancing Reasoning Capability of Vision-Language-Action Models31 Oct
  4. 2025Do What You Say: Steering Vision-Language-Action Models via Runtime Reasoning-Action Alignment Verification18 Oct
  5. 2025Training Strategies for Efficient Embodied Reasoning13 May
  6. 2025CoT-VLA: Visual Chain-of-Thought Reasoning for Vision-Language-Action Models27 Mar
  7. 2025Fine-Tuning Vision-Language-Action Models: Optimizing Speed and Success27 Feb
  8. 2024Robotic Control via Embodied Chain-of-Thought Reasoning11 Jul

Other references · 55

  1. 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,302
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2022Self-Consistency Improves Chain of Thought Reasoning in Language Modelscited by 5,601
  5. 2023RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Controlcited by 2,993
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  7. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  8. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
  9. 2024OpenVLA: An Open-Source Vision-Language-Action Modelcited by 2,777
  10. 2023Diffusion Policy: Visuomotor Policy Learning via Action Diffusioncited by 2,730
  11. 2024π0: A Vision-Language-Action Flow Model for General Robot Controlcited by 2,297
  12. 2022RT-1: Robotics Transformer for Real-World Control at Scalecited by 2,007
38 more
  1. 2016Adversarial examples in the physical worldcited by 1,762
  2. 2025π0.5: a Vision-Language-Action Model with Open-World Generalizationcited by 1,653
  3. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  4. 2023Learning Fine-Grained Bimanual Manipulation with Low-Cost Hardwarecited by 1,490
  5. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  6. 2024Octo: An Open-Source Generalist Robot Policycited by 1,427
  7. 2017Domain Randomization for Transferring Deep Neural Networks from Simulation to the Real Worldcited by 1,401
  8. 2023LIBERO: Benchmarking Knowledge Transfer for Lifelong Robot Learningcited by 1,338
  9. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  10. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  11. 2023Language Models Don't Always Say What They Think: Unfaithful Explanations in Chain-of-Thought Promptingcited by 1,081
  12. 2024DROID: A Large-Scale In-The-Wild Robot Manipulation Datasetcited by 801
  13. 2021Deep Reinforcement Learning at the Edge of the Statistical Precipicecited by 781
  14. 2017Deep Reinforcement Learning that Matterscited by 727
  15. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  16. 2024RDT-1B: a Diffusion Foundation Model for Bimanual Manipulationcited by 670
  17. 2019RLBench: The Robot Learning Benchmark & Learning Environmentcited by 669
  18. 2025FAST: Efficient Action Tokenization for Vision-Language-Action Modelscited by 643
  19. 2023BridgeData V2: A Dataset for Robot Learning at Scalecited by 634
  20. 2017Sim-to-Real Transfer of Robotic Control with Dynamics Randomizationcited by 616
  21. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  22. 2021CALVIN: A Benchmark for Language-Conditioned Policy Learning for Long-Horizon Robot Manipulation Taskscited by 564
  23. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  24. 2017Adversarial Patchcited by 514
  25. 2024Evaluating Real-World Robot Manipulation Policies in Simulationcited by 484
  26. 2019On Evaluating Adversarial Robustnesscited by 442
  27. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  28. 2024RoboCasa: Large-Scale Simulation of Everyday Tasks for Generalist Robotscited by 391
  29. 2024Prismatic VLMs: Investigating the Design Space of Visually-Conditioned Language Modelscited by 336
  30. 2017Synthetic and Natural Noise Both Break Neural Machine Translationcited by 304
  31. 2019Efficient and Accurate Estimation of Lipschitz Constants for Deep Neural Networkscited by 290
  32. 2023Faithful Chain-of-Thought Reasoningcited by 285
  33. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 281
  34. 2025LIBERO-Plus: In-depth Robustness Analysis of Vision-Language-Action Modelscited by 278
  35. 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 254
  36. 2017The Space of Transferable Adversarial Examplescited by 156
  37. 2023On the Adversarial Robustness of Multi-Modal Foundation Modelscited by 142
  38. 2025SafeChain: Safety of Language Models with Long Chain-of-Thought Reasoning Capabilitiescited by 133

50 most cited of 55 All 55 (JSON)

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Continuous Reasoning for Vision-Language-Action
  2. 2026Reasoning Dynamics and the Limits of Monitoring Modality Reliance in Vision-Language Models
  3. 2026Unmasking the Illusion of Embodied Reasoning in Vision-Language-Action Models
  4. 2026When Instructions Retrieve Trajectories: Diagnosing and Mitigating Generalization Failures in VLA Models
  5. 2025TRACE: A Framework for Analyzing and Enhancing Stepwise Reasoning in Vision-Language Models
  6. 2026Bridging Physical Reasoning and Task Generalization via Visual Action Outcome Reasoning Alignment
  7. 2026Think Less, Act Early: Reinforced Latent Reasoning with Early Exit in Vision-Language-Action Models
  8. 2026Do Vision-Language-Action Models Mean What They Say? On the Role of Faithfulness in Embodied Reasoning