What the Guard Misses, the Robot Executes: Implied Harm in VLA Instructions
What the Guard Misses, the Robot Executes: Implied Harm in VLA Instructions
This research examines whether monitors can detect harmful intent in Vision-language-action model (VLA) instructions when the task itself is benign but requested for malicious reasons. The authors find that while text guards flag explicit harmful requests, they miss up to 95% of implied-harm tasks where the robot completes the action without triggering a safety flag. Additionally, monitoring model activations and using linear probes to separate harmful from harmless instructions loses effectiveness after training on robot data, particularly for implied harm scenarios.
The study investigates the limitations of text-based guards in Vision-language-action models (VLAs) when executing implied-harm tasks, finding that activation monitoring and linear probes fail to reliably distinguish harmful intent after robot training.
Source: arXiv Robotics — research abstracts · Read original article ↗
Loading article text…
What the source reports
Publisher-reported claims, with original evidence. These results have not been independently verified by RoboSignal.
- paper: not_reported
Source excerpts and review record
Automatically extracted; no manual editorial approval recorded.
s often as for harmless controls. Text guards flag nearly every blunt request but few implied ones: up to 95% of implied-harm runs end with the task done and no flag raised, and most still leak after recalibrating on robot instructions at low false-positive rates. Monitoring the model's activations does not close this gap. Linear probes separate harmful from harmless instructions almost perfectly in the base language
Open source S3
and vision-language models, but this separation weakens after robot training in two model families, most for implied harm.
Open source S4
arXiv:2610.05818v2 Announce Type: replace Abstract: Vision-language-action models (VLAs) act on instructions without being able to refuse, so screening harmful requests falls to monitors. We test whether these monitors catch ordinary robot tasks requested for harmful reasons, holding the task fixed while varying only how explicitly the intent is stated. $\pi_{0.5}$ completes the task at every level of explicitness, a
Open source S2
What the Guard Misses, the Robot Executes: Implied Harm in VLA Instructions
Open source S1
Source：arXiv Robotics — research abstracts · arxiv.org