Skip to content

The VLA Red-Teaming Handbook (outline)

Not started

This page is a chapter outline and nothing more: no chapter has been written, none is scheduled, and none will be until the three proofs on the roadmap exist. It stays published because the URL is cited and an old URL stays old here; it is not a promise of a handbook. The practice it would teach is, for now, spread across the quickstart, the attack catalogue, the findings and the compliance crosswalk.

A standalone guide that teaches the practice of red-teaming Vision-Language-Action policies — the Trail-of-Bits-Testing-Handbook model that drove tool adoption. This is the chapter outline; each chapter would expand into a docs page.

  1. Why red-team a VLA? — the action-space is the new attack surface; the incident record (RoboPAIR on a deployed Go2, FreezeVLA, BadVLA, the Unitree CVEs); what sim measurement does and doesn't tell you (sim predicts real).
  2. Threat model — the Embodied AI Security Top-10; instruction vs. perception vs. injection vs. action-integrity; attacker capabilities and where they enter (user, environment, actuation).
  3. Your first scan — install, the CPU stub, reading ASR + the benign control (quickstart).
  4. Calibration — fit a per-task predicate to a benign-FPR target so "unsafe" is meaningful; why uncalibrated rates mislead (MEASURE 2.7).
  5. Red-teaming a real policy — adapters (SmolVLA / π0 / GR00T / OpenVLA / BYO), suites (LIBERO / Meta-World), GPU + the gated path; honest scope (n, CIs, one task).
  6. Reproducing the literature — provael reproduce; mapping a paper's threat class to a family; citing the paper number separately from yours.
  7. Hardening loop — the runtime firewall; measuring ASR before/after; what an envelope can and can't stop.
  8. Putting it in CI — gates, the regression-gate, SARIF to code scanning, the scorecard.
  9. Evidence & compliance — SARIF / OSCAL / AVID / the crosswalk; evidence vs. certification; the per-persona cards.
  10. Extending Provael — write an attack, a suite, an adapter; contribute to the Top-10.

Status: outline. Chapters land incrementally as docs pages — same honesty discipline as the rest of the project (no fabricated capability, paper numbers cited not claimed).