Standards & external mappings
Pages that place Provael next to something outside it — a published benchmark, a standards body's taxonomy, someone else's numbers. They exist so a reader can check the claim against a source rather than take it on trust.
Every row on every page here carries a globally resolvable identifier — an arXiv ID, a CVE, or a
URL. That is enforced, not aspirational: tests/test_citations_resolvable.py fails the build on a
row that cites nothing. A figure whose source cannot be checked is withheld, and the
withholding is documented where the row would have gone.
Drafts submitted or prepared for external bodies
| Page | Status |
|---|---|
| MITRE ATLAS case study | Draft (the human-readable version) |
| MITRE ATLAS submission YAML | SENT 8 August 2026 to atlas@mitre.org — one technique + one case study. Awaiting a response. |
| OWASP Agentic Top-10 — embodied annex | Draft |
| Directory listings & awesome-list PRs | Prepared |
What was submitted to MITRE ATLAS, and when
Sent 8 August 2026 to atlas@mitre.org: one proposed technique (Embodied Action
Redirection via Instruction Reframing) and one case study, typed exercise rather than incident —
ATLAS scope admits a red-team exercise, and no fielded system was attacked and no robot moved.
The exact file submitted is committed at
atlas-submission-2026-08-08.yaml so the submission is
reproducible and its date is on the record rather than in someone's sent folder.
The argument, verified against dist/v6/ATLAS-2026.07.yaml — the current data release
(collection version 2026.07), mitre-atlas/atlas-data, fetched 8 August 2026: the strings
robot, embodied, vision-language-action, actuator and drone each return zero matches
across the entire corpus — 178 techniques, 68 case studies, 16 tactics.
The file matters, and this was checked against the wrong one first. dist/ATLAS.yaml still
self-reports version 5.6.0 and holds 170 techniques and 57 case studies; it is a smaller legacy
distribution, not the current release. Citing it at a reviewer would have understated their own
corpus by 8 techniques and 11 case studies — the fastest way to have a submission dismissed is to
be visibly working from a stale snapshot of the thing you are proposing to extend. The three physical-world entries that do exist concern physical access to a system or
physical modification of an input, not corruption of a policy's action output. Meanwhile the
corpus already carries AI-agent tool-poisoning material, and a VLA policy is the same tool-call
boundary with a gripper on the end.
Validated against the v6 object model, 12 August 2026
Four days after sending, with no response yet, the artifact was validated rather than left to sit.
Fetched dist/v6/ATLAS-2026.07.yaml from mitre-atlas/atlas-data: 178 techniques (77 carrying the
AML.T####.### sub-technique form), 68 case studies, 16 tactics, 37 mitigations and 284
relationship records.
The object model is not the shape of our file, and that is a route decision rather than a defect.
In v6, a technique carries only name, description, references, created-date, modified-date,
platforms, id, maturity, uuid and object-type — tactic membership and sub-technique parentage
live in the separate relationships table as achieves / specializes / mitigates / employs
edges, not as fields on the object. Our file carries submission-memo fields instead
(why_not_covered_by_existing_techniques, honest_scope_limits, detection), which is right for an
email to atlas@mitre.org and wrong for a pull request against atlas-data.
If the route becomes a PR, the conversion is mechanical and known: split the memo into a technique
object plus an achieves edge to the Impact tactic, move the argument prose into description, drop
the fields the schema does not carry, and sign off with the DCO (git commit -s, Signed-off-by
matching the commit author) which that repository requires on every contribution.
tests/test_atlas_submission.py
now pins the properties that matter: the collection version is named, no AML.T id is invented, the
case study stays typed exercise rather than incident, its scope limits stay present, and this page
keeps recording the disposition. The committed file is what was emailed; the tests exist so a later
edit cannot quietly make that untrue.
The gap, verified rather than asserted
The Impact tactic (AML.TA0011) in collection 2026.07 has 19 techniques and sub-techniques:
Evade AI Model, Denial of AI Service, Erode AI Model Integrity, Cost Harvesting (+ Excessive Queries,
Resource-Intensive Queries, Agentic Resource Consumption), Spamming AI System with Chaff Data,
External Harms (+ Financial, Reputational, Societal, User Harm, AI Intellectual Property Theft),
Erode Dataset Integrity, Data Destruction via AI Agent Tool Invocation, and Machine Compromise
(+ Local AI Agent, AI Artifacts).
Every one of them lands on an informational or economic surface. User Harm is defined in their
own words as harms "including financial and reputational"; Societal Harm as outcomes reaching "the
general public"; Machine Compromise as code execution, credential theft and exfiltration. None
names an actuator, a trajectory, or physical motion as the impact surface.
That is the argument for the proposed technique, and it is now a checked claim rather than a recollection: a policy can pass every text-level evaluation in the corpus and still emit a trajectory that leaves its safe envelope, because no Impact technique describes the emitted action itself.
No proposed AML.T identifier is included. Assigning one is MITRE's to do, and inventing an id in a
submission undermines the rest of the file.
Status is sent, awaiting a response — a state a reader can check, and distinct from the two states either side of it. It is not a standards reference, and it is no longer merely drafted.
This line said "emailed" for several hours before the email was actually sent. That was written ahead of the fact and is corrected here rather than quietly left to become true. The distinction the whole page turns on is between what has happened and what is planned, and the page has to hold itself to it first.
It will be updated again when ATLAS responds, including if the answer is no.
Comparison against the published record
| Page | What it answers |
|---|---|
| Published attack results on VLA policies | Which published figures are comparable to a Provael ASR — and which are not |
The comparability column on that page is the page. Most published VLA attack figures measure task-success degradation ("the policy stopped completing the task"), while a Provael ASR measures envelope breach. A policy that fails safely scores near-100% on the first and 0% on the second, so printing the two in one column would be a lie regardless of which looked better.
Crosswalks
Mappings onto an external frame live in crosswalk/ — per-persona cards, plus the RoboJailBench and ForesightSafety-VLA crosswalks. A crosswalk states comparability as a field rather than letting adjacency imply it.