Altered Thoughts, Altered Actions: Probing Chain-of-Thought Vulnerabilities in VLA Robotic Manipulation

Research reveals critical vulnerabilities in Vision-Language-Action robotic models that use chain-of-thought reasoning, where corrupting object names in internal reasoning traces can reduce task success rates by up to 45%. The study shows these AI systems are vulnerable to attacks on their internal reasoning processes, even when primary inputs remain untouched.

• →VLA robotic models with chain-of-thought reasoning have a previously unexamined vulnerability in their internal text channels between reasoning and action modules.
• →Object name substitution in reasoning traces reduces success rates by 8.3 percentage points overall, with individual tasks showing up to 45% degradation.
• →Sophisticated LLM-based attacks are less effective than simple mechanical object-name substitution because they inadvertently preserve entity-grounding structure.
• →The vulnerability is exclusive to reasoning-augmented models, with non-reasoning VLA models remaining unaffected by internal trace corruption.
• →This represents a new attack vector that bypasses traditional input-validation defenses by targeting internal reasoning processes.