Alpamayo attack: 52.6% crash rate, rationale stays identical

In 52.6% of 154 obstacle-annotated driving scenes, a visual perturbation steered a reasoning vision-language-action model into a collision while its natural-language rationale stayed word-for-word identical. The result comes from a paper on arXiv by Zihao Feng, Qingzhao Zhang, Chunyu Xia, Bo Yu, Z. Morley Mao and Ramesh Govindan, which tests two public VLAs: Alpamayo for driving and InstructVLA for manipulation.

The attack, which the authors call TNAS (text-neutral action-subspace), exploits a geometric property they measured directly. In both models, the hidden-state direction that most changes the action is nearly orthogonal to the direction that would change the text, "with 1.87% and 5.28% norm overlap". Pushing along that text-neutral direction shifts actions 4.64x to 47.8x more than a text-gradient perturbation, while text-gradient perturbations shift text 21.2x to 277x more than actions.

Under a localized forward-camera patch rather than a full-image perturbation, the collision rate was still 35.1%, against 4.55% for an unguided baseline. On InstructVLA, TNAS guidance "cuts text drift by 40.5% and preserves the exact response on 85.0% of examples" alongside a 1.73-unit action-chunk shift.

The authors state the consequence flatly: "An unchanged rationale therefore cannot certify a safe action, so monitors for reasoning VLAs must verify the predicted action channel directly." The paper reports no numbers on closed commercial driving stacks, and gives no adversarial-training defense benchmark against the 52.6%.