Reasoning as a Double-Edged Sword: Architecture and Cross-Stage Robustness in Vision-Language-Action Models
2026-07-20 • Robotics
RoboticsArtificial IntelligenceCryptography and SecurityMachine Learning
AI summaryⓘ
The authors tested if adding a reasoning step helps vision-language-action models handle input problems better. They compared three models: one with no reasoning, one with text-based reasoning, and one with a more complex iterative reasoning loop. Surprisingly, the complex reasoning model was the least robust to different kinds of disturbances, while the others were more stable. They also tried to see if reasoning steps could be used to detect failures, but those checks did not work well under tough conditions. Their study suggests that reasoning alone doesn't guarantee better reliability or safety signals in these models.
Vision-Language-Action modelsrobustnessperturbationchain-of-thought reasoninglatent iterative reasoningstochastic noisewhite-box attacksafety signalmonitoringaction anomaly detection
Authors
Tuan Duong Trinh, Naveed Akhtar, Basim Azam
Abstract
Does adding a reasoning step make a Vision-Language-Action (VLA) model more robust to perturbation? Intuitively, a policy that reasons before acting should absorb a perturbed input better than one that maps observations directly to actions. We test this premise head-on across three models that span the reasoning spectrum (no reasoning, a text chain-of-thought, and a latent iterative loop), perturbing each at the vision, reasoning, and action stages on LIBERO and SimplerEnv. Two questions organize the study: does the reasoning design shift robustness, and can the reasoning be read back at runtime as a safety signal? We find that the latent-iterative model is by far the least robust: under both stochastic noise and white-box perturbation its task success collapses, while the other two hold. This fragility is structural rather than cumulative: varying the reasoning depth at inference barely moves it. Reasoning outputs can in principle be monitored, but the monitors fail under fair tests. A plan--action consistency probe that looks near-perfect under naive evaluation falls to chance under adaptive attack. Under matched-FPR calibration, fusing it with an action-anomaly probe never lifts defended success above undefended. Scoped to these output-level behavioral probes under white-box vision-stage attack, this ceiling is a precondition that any viable defense must first satisfy.