Same Rationale, Different Action: The Hidden Safety Gap in Reasoning VLAs

Introduction

Reasoning vision-language-action (VLA) models are designed to connect perception, natural-language reasoning, and physical control. A model may explain why it intends to slow down, avoid an obstacle, or move an object before producing the corresponding action. This verbal layer is attractive for safety oversight because human supervisors can inspect it.

A paper featured on Hugging Face Daily Papers argues that such inspection can create a false sense of security. Its central finding is simple but consequential: a model can say exactly the same thing while doing something different.

Key findings

• The rationale does not have to change. Earlier attacks on VLA reasoning often left visible evidence by corrupting the generated explanation. This work instead searches for visual perturbations that shift the physical action while preserving the text.
• TNAS isolates action-sensitive directions. At the shared text/action interface of Alpamayo, a driving model, and InstructVLA, a manipulation model, the authors identify hidden-state directions that are highly sensitive for action but relatively neutral for text loss. They call this the text-neutral action subspace, or TNAS.
• Text is an incomplete readout of the policy state. The locally most action-sensitive direction overlaps with active text-loss gradients by only 1.87% in Alpamayo and 5.28% in InstructVLA. In other words, preserving the text does not imply preserving all control-relevant information.
• Driving results reveal a monitoring blind spot. Across 154 obstacle-annotated Alpamayo scenes, TNAS-guided full-image perturbations caused a new collision with a word-for-word identical rationale in 52.6% of scenes. A localized patch on the forward camera still reached 35.1%, compared with 4.55% for unguided action attacks.
• The pattern extends beyond driving. In InstructVLA, the intervention could preserve the exact response on many examples while shifting the action chunk, indicating that the issue is not limited to one application.

Why it matters

The study does not establish that every VLA will fail in precisely this way. It does, however, expose a weakness in a common evaluation assumption: that a plausible or unchanged explanation is a dependable proxy for safe behavior. Language is a many-to-one readout of the model’s hidden state. Relevant differences for control may therefore remain invisible in the generated rationale.

Safety systems should consequently inspect actions, trajectories, and predicted collision risk directly, rather than relying only on text consistency. Evaluation suites should include counterfactual tests where the rationale is held constant while the action is measured for drift, under both global and localized visual perturbations.

The broader architectural question is whether text and action should share an interface without stronger alignment constraints. For embodied AI, interpretability is not achieved merely when a model can explain itself. The explanation must also remain coupled to what the system actually does.

Source: Hugging Face Daily Papers