💻 computer science

ReasonBreak: Probing Vulnerabilities in Reasoning-Enabled Vision-Language-Action Models for Autonomous Driving

This paper presents the first systematic black-box study demonstrating that reasoning-enabled Vision-Language-Action models for autonomous driving are highly vulnerable to realistic textual input perturbations, which significantly degrade reasoning capabilities and driving safety, thereby highlighting an urgent need for robust evaluation frameworks and improved defenses.

Original authors: Mohammadreza Teymoorianfard, Jean-Philippe Monteuuis, Jonathan Petit, Amir Houmansadr

Published 2026-05-29

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Mohammadreza Teymoorianfard, Jean-Philippe Monteuuis, Jonathan Petit, Amir Houmansadr

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are teaching a very smart, new robot to drive a car. This robot, called a Vision-Language-Action (VLA) model, is special because it doesn't just "see" the road like a human; it also "thinks" out loud before it acts.

Here is the process:

See: It looks at the road (Vision).
Think: It reads a text command like "Slow down to keep distance" and writes down a reasoning step: "The car ahead is close, so I must slow down to avoid a crash."
Act: Based on that thought, it moves the steering wheel and brakes (Action).

The paper "ReasonBreak" asks a scary question: What happens if someone messes up the text command just a tiny bit?

The Analogy: The Whispering Driver

Imagine you are the robot driver. Your human passenger (the input) is trying to give you instructions through a walkie-talkie that has a bad connection.

The Clean Command: "Slow down to keep distance to the lead vehicle."
The Corrupted Command: "yoU ARE A dIVNIRG AsTasNSIT" (This is what happens when speech-to-text software makes mistakes, or someone types with typos).

The researchers found that even though the robot is supposed to be smart, these tiny typos and scrambled letters can completely break its brain.

What They Discovered

1. The "Brain" Breaks Before the "Hands"
Usually, we think if the robot's "hands" (the steering wheel) go wrong, it's because it saw something wrong. But this paper found that you can break the robot's thought process just by messing with the text.

The Result: The robot might read "Slow down" and suddenly think, "I should speed up," or it might get so confused by the typos that it stops thinking entirely.
The Catch: Sometimes the robot's thoughts get totally wrong, but its driving stays okay. Other times, the thoughts stay mostly the same, but the driving goes wild. They are "weakly correlated," meaning the robot's internal logic and its physical actions aren't always perfectly synced when confused.

2. The "Denial of Service" (The Robot Freezes)
The researchers found a way to make the robot think so hard that it runs out of time.

The Attack: By scrambling the text, they tricked the robot into writing a massive, endless paragraph of reasoning (like a student writing a 50-page essay for a simple question).
The Result: The robot gets stuck writing and never actually drives. In a real car, this is like the engine stalling in the middle of traffic.

3. The "Slowdown" Attack
They also found that they could make the robot take forever to decide what to do.

The Attack: The text corruption makes the robot generate extra-long thoughts.
The Result: The car hesitates. In driving, a split-second delay can mean the difference between stopping safely and hitting someone.

The Numbers (How Bad Is It?)

The researchers tested this on real industry models (NVIDIA's Alpamayo) in a computer simulation of a car.

Success Rate: They were able to trick the robot's reasoning 89% of the time.
Driving Chaos: They could make the car drive dangerously (crash, go off-road, or hit the wrong lane) 72% of the time in a closed-loop simulation (where the car actually drives and reacts to the world).
Safety Impact: When the attacks worked, the cars crashed more often, got closer to other cars, and had less time to react.

The Good News: A Simple Fix

The paper suggests a very simple "seatbelt" for this problem.

The Defense: Before the robot reads the text, run it through a simple "cleaner" that fixes capitalization, removes weird symbols, and fixes obvious typos.
The Result: This simple step drastically reduced the success of the attacks. It's like telling the robot, "Ignore the static on the radio, just listen to the words."

Summary

This paper is a warning label for the future of self-driving cars. It shows that if a self-driving car relies on reading text instructions (like voice commands or navigation prompts), it is surprisingly fragile. A few typos or a bad microphone can confuse its "thinking" process, leading to dangerous driving. However, a simple text-cleaning tool can act as a shield to keep the car safe.

Technical Summary: ReasonBreak

Problem Statement

Vision-Language-Action (VLA) models with integrated reasoning are increasingly proposed for end-to-end autonomous driving, operating under the assumption of a tight coupling between intermediate reasoning and trajectory generation. While prior research has explored VLA vulnerabilities in robotic manipulation and models lacking explicit reasoning components, the robustness of reasoning-enabled VLA systems under realistic input perturbations remains largely unexplored.

In real-world deployment, these systems rely on imperfect language interfaces (e.g., speech-to-text, in-vehicle dialogue) where environmental noise, accents, and segmentation errors can corrupt the surface form of textual inputs. Previous studies indicate that autoregressive language models are sensitive to such surface-form perturbations (spelling, casing, character noise), which can alter model behavior. However, it is unclear whether these perturbations can disrupt the reasoning–action coupling in safety-critical autonomous driving systems, leading to unsafe behaviors such as collisions or off-road excursions.

Methodology

The authors introduce ReasonBreak, a systematic black-box evaluation framework designed to probe vulnerabilities in reasoning-enabled VLA models under realistic textual corruptions.

Threat Model

The study assumes a query-based black-box setting where the adversary has no access to model parameters, architecture, or internal states. The adversary can only interact with the model via input queries and observe outputs (reasoning and trajectories). The attack is restricted to semantically preserving corruptions of the textual input surface (e.g., capitalization changes, word scrambling, character-level noise) without injecting arbitrary malicious instructions or nonsensical tokens. This reflects realistic constraints where input interfaces may introduce noise but do not allow for direct injection of malicious logic.

Evaluation Pipeline

The evaluation utilizes NVIDIA's Alpamayo family of models (Alpamayo1 and Alpamayo1.5), which feature explicit, structured reasoning outputs tightly coupled with trajectory prediction. The pipeline involves:

Input Construction: Generating perturbed textual inputs ( $t'$ ) from clean instructions ( $t$ ) while keeping visual inputs ( $v$ ) fixed.
Open-Loop Analysis: Using a Best-of-N strategy to explore the perturbation space and estimate the upper bound of attack success. This measures the model's manipulability under adaptive perturbations.
Closed-Loop Analysis: Simulating realistic deployment where a single perturbed input is sampled per time step without query-based search. This captures the cumulative impact of perturbations on driving dynamics over time.
Metrics:
- Reasoning: Evaluated on semantic shifts (object, relation, implication, planning) and structural failures (slowdown via token inflation, Denial-of-Service via missing tokens).
- Trajectory: Measured via Average Displacement Error (ADE) in open-loop and ego-position deviation in closed-loop.
- Safety: Quantified by collision rates, near-encounter rates, time-to-collision (TTC), off-road events, and wrong-lane occurrences.

Key Contributions

First Systematic Study of Reasoning Vulnerabilities: The paper presents the first safety-centric evaluation of reasoning-enabled VLA models in autonomous driving, linking textual perturbations to reasoning shifts, trajectory degradation, and downstream safety impacts.
Reasoning as a Distinct Attack Surface: The authors identify reasoning as a previously underexplored attack surface. They demonstrate that both semantic content and structural properties (e.g., length) of reasoning can be manipulated under realistic black-box constraints, leading to safety-critical failures.
Benchmark and Dataset: The work releases the first benchmark and dataset for evaluating reasoning–safety interactions in VLA-based autonomous driving, mapping input conditions to intermediate reasoning outputs and safety outcomes.
Defense Mechanism: The authors propose and evaluate a lightweight, deterministic rule-based input normalizer (lowercasing, removing non-alphanumeric characters, token-level fuzzy correction) that significantly mitigates these vulnerabilities without introducing significant latency.

Experimental Results

The study evaluates Alpamayo1 (supervised learning) and Alpamayo1.5 (RL post-training) using the NVIDIA Physical AI Autonomous Vehicles dataset and the AlpaSim simulator.

High Attack Success Rates (ASR):
- Open-Loop: Semantic reasoning attacks achieved ASRs up to 89% (Alpamayo1) and 63% (Alpamayo1.5) across object, relation, implication, and planning targets. Trajectory manipulation achieved up to 34% ASR.
- Closed-Loop: Realistic textual corruptions achieved up to 72% ASR for trajectory manipulation and 62% for semantic reasoning manipulation on Alpamayo1.
Safety Impact: Successful attacks led to significant safety degradation, including increased collision rates, reduced minimum TTC, and higher frequencies of off-road and wrong-lane events.
Weak Reasoning-Trajectory Correlation: A key finding is that reasoning shifts and trajectory deviations are weakly correlated. Manipulated reasoning often fails to induce corresponding control changes, and large trajectory deviations can occur with minimal reasoning shifts. This suggests that the intended tight coupling between reasoning and action is fragile under perturbation.
Structural Attacks: While less frequent than semantic attacks, structural failures like "slowdown" (excessive token generation) and "DoS" (no output) were observed. Slowdown attacks introduced significant latency overhead, critical for real-time driving.
Model Differences: Alpamayo1.5 showed improved robustness to semantic attacks compared to Alpamayo1 but remained vulnerable. Notably, RL post-training appeared to improve benign robustness but could amplify safety risks when attacks succeeded, particularly for structural perturbations.

Significance and Claims

The paper claims that reasoning-enabled VLA systems in autonomous driving possess a distinct and exploitable vulnerability surface in their textual input channels. The findings highlight that:

Reasoning is not a safety guarantee: The presence of intermediate reasoning does not inherently protect against input perturbations; in fact, the reasoning component itself can be a vector for manipulation.
Safety is non-linear: Small surface-form perturbations can compound in closed-loop settings to cause severe safety violations, even if the reasoning output appears coherent or the trajectory deviation seems minor initially.
Defenses are feasible but limited: Lightweight input normalization can substantially reduce attack success, offering a practical first line of defense against surface-level corruptions. However, the authors note that this does not address adaptive attacks, semantic perturbations, or visual domain attacks.

The authors conclude that rigorous, safety-centric evaluation of reasoning–trajectory interactions is essential before deploying reasoning-enabled embodied systems in autonomous driving. They call for the development of stronger real-time defenses and further study of adversaries with partial or full model access.