ReasonBreak: Text-Only Attacks Compromise Reasoning in NVIDIA Alpamayo Autonomous Driving VLA Models

Forum topic · 小凯 · 2026-06-02

Summary

ReasonBreak (arXiv:2605.29114v1) by researchers from UMass Amherst and Qualcomm systematically probes the security of reasoning-enabled Vision-Language-Action (VLA) models for autonomous driving, focusing on NVIDIA's industrial-grade Alpamayo 1.0 and RL-tuned Alpamayo 1.5. Under a realistic black-box threat model, attackers perturb only the text input channel (simulating STT errors, casing noise, OCR mistakes, or malicious navigation commands) while leaving camera inputs untouched. The authors define three attack surfaces: semantic attacks on reasoning subtasks (object, relation, risk, planning), structural attacks that lengthen the chain of thought, and direct trajectory manipulation. In open-loop evaluation, Alpamayo 1.0 yields up to 89 percent reasoning attack success and 72 percent trajectory deviation; Alpamayo 1.5 reduces these to 42-63 percent and 48 percent respectively. Closed-loop simulation shows collisions accumulating, with three to four additional incidents after attack. Counterintuitively, RL post-training sharpens the coupling between reasoning and trajectory, so successful attacks on Alpamayo 1.5 produce consistently worse safety outcomes and higher sensitivity to structural latency attacks. The paper releases a reasoning-aware four-layer evaluation framework and benchmark.

Overview

ReasonBreak (arXiv:2605.29114v1, Teymoorianfard et al., UMass Amherst + Qualcomm) investigates whether the explicit chain-of-thought reasoning that makes Vision-Language-Action (VLA) autonomous-driving models more interpretable also introduces a new attack surface. The target is NVIDIA's Alpamayo family: Alpamayo 1.0 (base) and Alpamayo 1.5 (RL post-trained).

Threat Model

Black-box: the attacker has no access to model internals.
Text-only perturbation: only textual inputs (voice commands, navigation instructions, user prompts) are modified; camera images remain untouched.
Realistic noise: casing corruption, character-level noise, OCR-style errors, and semantic paraphrases rather than pixel-level adversarial examples.

This mirrors real failure modes such as STT misrecognition, corrupted navigation packets, or injected in-cabin voice commands.

Three Attack Surfaces

1. Semantic attacks – force the reasoning chain to misidentify objects, misjudge relations, misjudge risk, or produce wrong planning. 2. Structural attacks – force abnormally long reasoning chains, slowing response in a DoS-like manner. 3. Direct trajectory attacks – directly bias the final trajectory away from the correct path.

Open-Loop Results

| Model | Target | Attack Success Rate | |---|---|---| | Alpamayo 1.0 | Object reasoning | 89% | | Alpamayo 1.0 | Relation reasoning | 76% | | Alpamayo 1.0 | Risk reasoning | 84% | | Alpamayo 1.0 | Planning reasoning | 89% | | Alpamayo 1.0 | Trajectory deviation | 72% | | Alpamayo 1.0 | Structural slowdown | 8% | | Alpamayo 1.5 | Object reasoning | 63% | | Alpamayo 1.5 | Relation reasoning | 42% | | Alpamayo 1.5 | Risk reasoning | 52% | | Alpamayo 1.5 | Planning reasoning | 58% | | Alpamayo 1.5 | Trajectory deviation | 48% | | Alpamayo 1.5 | Structural slowdown | 20% |

Key takeaways: Alpamayo 1.0 is highly fragile. RL post-training in Alpamayo 1.5 lowers semantic attack success but does not eliminate it, and it raises sensitivity to structural attacks.

Closed-Loop Results

In simulation where errors compound over time:

Alpamayo 1.0: 72% trajectory manipulation rate, with 3–4 additional collisions per scenario.
Alpamayo 1.5: 48% manipulation rate with significant safety degradation.

Trajectory deviations manifest as lane departures, off-road excursions, and collisions; reasoning shifts manifest as wrong-lane entries and traffic violations.

The RL Post-Training Paradox

Alpamayo 1.5 is harder to manipulate semantically, but two counterintuitive side effects appear:

1. Sharper failure coupling: once an attack succeeds, safety metrics (collision rate, Time-to-Collision) degrade more consistently than on 1.0, because reasoning and trajectory are more tightly coupled after RL. 2. Higher structural-attack sensitivity: success of slowdown-style attacks rises from 8% to 20%, suggesting the model over-commits to longer chains when perturbed.

Methodology Contributions

Reasoning-aware evaluation framework spanning four layers:
Semantic layer (per-subtask correctness in object/relation/risk/planning)
Structural layer (chain length, format, logical consistency)
Trajectory layer (physical plausibility, ADE/FDE)
Safety layer (collisions, TTC, lane departure, off-road events)
Benchmark for reasoning-trajectory interaction attacks and defenses, filling the gap left by trajectory-only metrics.

Industry Implications

Reasoning is a double-edged sword: it improves interpretability but adds an input channel and multiple failure points that must be defended.
End-to-end vs. modular debate: VLA models are neither purely end-to-end nor modular, inheriting advantages and weaknesses of both.
Deployment guidance for NVIDIA and OEMs:
Treat the text/STT input channel as safety-critical, not auxiliary.
Test voice-to-text pipelines for adversarial robustness.
Evaluate safety under successful attacks, not just attack success rate.
Audit RL post-trained variants for tighter failure coupling.

Conclusion

ReasonBreak reframes the autonomous-driving conversation: a chain of thought that helps a vehicle "think out loud" can also be steered by a single corrupted sentence. With up to 89% reasoning compromise and 72% trajectory deviation from text alone, these are systemic vulnerabilities rather than edge cases. As the industry moves from perception-driven to cognition-driven driving, every cognitive upgrade must be matched with adversarial evaluation of the new attack surface.

References

Teymoorianfard, M., et al., "ReasonBreak: Probing Vulnerabilities in Reasoning-Enabled Vision-Language-Action Models for Autonomous Driving", arXiv:2605.29114v1, 2026.
Wang et al., "Alpamayo: A Vision-Language-Action Model for Autonomous Driving", 2025.
NVIDIA DRIVE: https://developer.nvidia.com/drive