Reasoning as a Double-Edged Sword: Architecture and Cross-Stage Robustness in Vision-Language-Action Models

Paper: Reasoning as a Double-Edged Sword: Architecture and Cross-Stage Robustness in Vision-Language-Action Models
Authors: Tuan Duong Trinh, Naveed Akhtar, Basim Azam
Affiliation: University of Melbourne, Australia
Link: arXiv:2607.17786v1 [cs.RO], July 2026
Code: ❌ No public code released

1. Abstract

Does adding a reasoning step make a Vision-Language-Action (VLA) model more robust to perturbation? Intuitively, a policy that reasons before acting should absorb a perturbed input better than one that maps observations directly to actions. This paper tests this premise head-on across three models spanning the reasoning spectrum (no reasoning, text chain-of-thought CoT, latent iterative loop), perturbing each at the vision, reasoning, and action stages on LIBERO and SimplerEnv manipulation benchmarks. Key finding: the latent iterative reasoning model (RD-VLA) is the most fragile — task success rate collapses to near-0% under both Gaussian sensor noise and white-box PGD-10, while the other two remain far more robust. The amplification is structural, not cumulative: extending recurrence depth from K=8 to K=12 leaves amplification essentially unchanged (ρ(12)/ρ(8)=1.005 vs multiplicative prediction 2.0). Further testing reasoning as runtime defense: the plan-action consistency probe collapses to chance under adaptive attack (AUC 0.493), and fusing with an action-anomaly probe fails to raise defended success rate under matched FPR.

2. Background and Motivation

VLA models pair a vision-language backbone with an action head, with a growing number adding an explicit reasoning step: text CoT plans or latent iterative refinement. The safety intuition — that reasoning before acting should better absorb perturbed input — remains largely untested. Existing robustness benchmarks treat the model as a black box, never isolating the reasoning step.

Two core questions:

• When a perturbation enters the pipeline, does reasoning attenuate, relay, or amplify it?
• When reasoning is exposed as an explicit plan, can that plan serve as a runtime check on the action it drives?

Figure 1: Three VLAs spanning the reasoning spectrum. OpenVLA-OFT (no reasoning), DeepThinkVLA (text CoT), RD-VLA (latent iterative). Red dashed arrows mark stage-wise attack injection points: vision, reasoning (DT only), action.

3. Core Method

3.1 VLA Pipeline and Threat Model

A VLA model maps visual observations $\mathbf{o}_t\in\mathbb{R}^{H\times W\times 3}$ and task instruction $\ell$ to a 7-DOF action $\mathbf{a}_t\in\mathbb{R}^{7}$ through three stages (vision encoder $f_v$, optional reasoning module $f_r$, action head $f_a$):

$$\mathbf{a}_t=f_a\bigl(f_r\bigl(f_v(\mathbf{o}_t),\ell\bigr)\bigr)$$

Three models span the reasoning spectrum:

• OpenVLA-OFT: Single-pass, ~7B, Prismatic backbone with MLPResNet action head, clean SR 96.5%
• DeepThinkVLA (DT): Text CoT, ~3B, PaliGemma backbone, discrete action tokens, clean SR 93.0%
• RD-VLA: Latent iterative, K=12 weight-tied recurrence, 0.5B, Prismatic backbone, linear action projection, clean SR 89.2%

Evaluated on LIBERO's 4 suites × 10 tasks × 3 seeds; analysis unit is the matched (suite, seed) cell, each a mean SR over 50 episodes (N=12 cells/condition).

3.2 Cross-Stage Attack Matrix

One perturbation injected at a single pipeline stage to isolate reasoning architecture effects. Stage-$s$ adversary with budget $\varepsilon$ perturbs $\tilde{x}_s=x_s+\delta_s$:

• Vision stage: FGSM sweep $\varepsilon\in\{2,4,8,16,32\}/255$, Gaussian sweep $\sigma\in\{0.01,...,0.2\}$
• Reasoning stage: Entity-swap CoT (DT only, semantic corruption of reasoning channel)
• Action stage: Gaussian noise on 7-DOF output (gripper excluded)

flowchart LR
    A[Visual Obs o_t] --> B[Vision Encoder f_v]
    B --> C[Perturb δ_v
FGSM/Gaussian]
    C --> D{Reasoning Module f_r}
    D -->|No Reasoning OFT| E[Direct to Action Head]
    D -->|Text CoT DT| F[Generate Text Plan
Perturb δ_r: Entity Swap]
    D -->|Latent Iterative RD-VLA| G[K=12 Recurrence
Amplifies Perturbation]
    F --> H[Action Head f_a]
    G --> H
    E --> H
    H --> I[Action a_t
Perturb δ_a: Gaussian]
    I --> J[Environment Execution]

4. Key Experiments

4.1 Cross-Stage Robustness Ordering

18 stage-wise attack conditions, 4 LIBERO suites × 3 seeds (N=12/cell):

Table 2: Cross-stage robustness summary. DT and OFT withstand Gaussian noise, RD-VLA collapses. PGD-10 establishes strict three-tier ordering DT > OFT ≫ RD-VLA.

Under Gaussian noise σ=0.2, RD-VLA collapses (14.8%, Δ=-74.3pp), while DT (92.7%) and OFT (89.0%) withstand (two-tier: DT-vs-OFT inconclusive p=0.30; both differ from RD-VLA significantly p<0.01, d=6.5).

White-box PGD-10 ε=8/255 separates DT from OFT, establishing a strict three-tier ordering: DT 49.8% > OFT 18.2% > RD-VLA 0.0%.

Figure 3: The σ=0.2 collapse in rollouts. RD-VLA (top) leaves object untouched and fails; DT (bottom) completes pick-and-place.

4.2 K-Sweep Falsification: Amplification is K-Invariant, Not Multiplicative

RD-VLA's reasoning module is a weight-tied recurrence $f_r=g^{\circ K}$, the same function $g$ applied K=12 times. Standard Lipschitz intuition predicts multiplicative growth $\rho(K)\approx L_{\text{iter}}^K$. Direct test:

The amplification ratio measures output perturbation magnitude per unit input:

$$\rho(K)=\overline{\|\Delta a\|_2}/\varepsilon$$

ρ(12)/ρ(8)=1.005, while the multiplicative prediction (back-solved $\hat{L}_{\text{iter}}=1.192$) is 2.0. The multiplicative prediction is:

$$\rho(K)\approx L_{\text{iter}}^{K},\quad \hat{L}_{\text{iter}}=1.192$$

The observed value sits ~80 pooled-SE units below the prediction. The multiplicative form is falsified. Amplification is structural — a fixed property of the encoder and the recurrence's fixed point, not something that grows with depth.

Table 3: RD-VLA K-sweep. Per-step amplification ρ(K) is statistically flat across K, falsifying the L_iter^K hypothesis.

4.3 Reasoning-Based Runtime Defenses

Plan-Action Consistency Probe (text CoT model DT only): Scores plan-instruction consistency $s=w_e S_{\text{entity}}+w_d S_{\text{direction}}+w_g S_{\text{gripper}}+w_p S_{\text{parse}}$. Evaluated under an adaptive attack ladder:

Naive entity-swap is detected almost perfectly (AUC=0.996), but adaptive attack reduces it to chance (0.493) or below (0.259). Vision-stage attacks need no adaptive ladder — the perturbation enters both branches through the same perturbed latent. The structural bound is:

$$\text{clean-vs-attacked shift} \leq 1-\bar{\phi}_{\text{clean}}=0.133$$

The perturbation enters both branches through the same perturbed latent, so the consistency probe sees both shift coherently (structural bound: clean-vs-attacked separation $\leq 1-\bar{\phi}_{\text{clean}}=0.133$).

Stage-Fused Monitor: Fuses consistency probe $\phi_t$ and action-anomaly probe (Mahalanobis distance empirical-CDF rank $\psi_t$), scoring each step:

$$s_t=\alpha(1-\phi_t)+(1-\alpha)\psi_t,\quad \alpha\in[0,1]$$

Sweeping fusion weight α under matched 8% FPR:

Under matched FPR, no convex combination raises defended SR above undefended. Fusion (α=0.5) is worse than its own text-only ablation (α=1). An adaptive attacker further drops defended SR to 46.0% (object) and 50.7% (spatial).

5. Limitations and Future Work

• Single model per reasoning paradigm (N=3): Backbone, scale, training data, and action head are confounded with reasoning family. Paradigm-level statements are model-level observations; within-paradigm replication is a natural extension.
• All simulation: LIBERO plus a single-architecture SimplerEnv check; sim-to-real transfer is open.
• Stage-fused monitor evaluated post hoc: Adaptive evaluation covers only the action-anomaly term, not jointly with text-consistency. Future: closed-loop deployment and jointly adaptive evaluation.
• Future directions: Probes accessing intermediate representations; training-time interventions on the reasoning stage; threat models excluding white-box vision-stage attack.

6. Conclusion

This paper directly tests the intuition that "reasoning makes VLAs more robust," concluding it is a double-edged sword. Across three models spanning the reasoning spectrum, latent iterative reasoning (RD-VLA) is the most fragile, collapsing to near-0% success under Gaussian noise and PGD-10, while text-CoT and no-reasoning models remain far more robust. The key mechanistic finding: amplification is structural, not cumulative — the K-sweep falsifies the multiplicative Lipschitz hypothesis (ρ(12)/ρ(8)=1.005 vs predicted 2.0), placing the amplifier in the encoder and the recurrence's fixed point rather than per-iteration accumulation. On the defense side, two widely-studied post-hoc probe families (text-consistency, action-anomaly) fail to raise defended success rate under fair matched-FPR testing — the text probe collapses to chance under adaptive attack (AUC 0.493), and the fused monitor underperforms undefended at every convex combination. These results establish a ceiling (precondition) for defense work, not a no-go theorem. Across the three models, what separates them under cross-stage attack is how the reasoning stage is built, not whether one is present.