Reasoning as a Double-Edged Sword: Architecture and Cross-Stage Robustness in Vision-Language-Action Models

2026-07-20

AI Summary

This study investigates whether incorporating reasoning mechanisms enhances the robustness of vision-language-action (VLA) models under multi-stage perturbations and evaluates the efficacy of reasoning outputs as runtime safety signals. Through systematic comparisons among three architectures—no reasoning, textual chain-of-thought, and implicit iterative reasoning—the work reveals that implicit iterative reasoning substantially degrades robustness under adversarial perturbations, a limitation not mitigated by adjusting reasoning depth. Furthermore, existing monitoring approaches based on reasoning outputs fail under adaptive attacks, and even fusion probes struggle to improve defense success rates. This work is the first to expose these critical limitations, establishes an upper bound on output-level defense performance under white-box visual attacks, and sets a new benchmark for VLA safety.

Abstract

Does adding a reasoning step make a Vision-Language-Action (VLA) model more robust to perturbation? Intuitively, a policy that reasons before acting should absorb a perturbed input better than one that maps observations directly to actions. We test this premise head-on across three models that span the reasoning spectrum (no reasoning, a text chain-of-thought, and a latent iterative loop), perturbing each at the vision, reasoning, and action stages on LIBERO and SimplerEnv. Two questions organize the study: does the reasoning design shift robustness, and can the reasoning be read back at runtime as a safety signal? We find that the latent-iterative model is by far the least robust: under both stochastic noise and white-box perturbation its task success collapses, while the other two hold. This fragility is structural rather than cumulative: varying the reasoning depth at inference barely moves it. Reasoning outputs can in principle be monitored, but the monitors fail under fair tests. A plan--action consistency probe that looks near-perfect under naive evaluation falls to chance under adaptive attack. Under matched-FPR calibration, fusing it with an action-anomaly probe never lifts defended success above undefended. Scoped to these output-level behavioral probes under white-box vision-stage attack, this ceiling is a precondition that any viable defense must first satisfy.

Problem

• robustness
• reasoning
• Vision-Language-Action models
• perturbation
• safety signal

Innovation

• vision-language-action models
• reasoning robustness
• white-box perturbation
• latent iterative reasoning
• safety monitoring