Then: models that talk
Language models learned to read and write. When they failed, a human read the output and could ignore it. The world stayed untouched.
[ research collective · est. 2026 ]
Intelligence is getting a body.
RobSafe is where ML safety meets robotics. We reproduce papers, take networks apart, and hunt for vulnerabilities, so the machines that will move through our world fail safely, if they fail at all.
For a decade, machine learning lived behind glass. Its mistakes were words on a screen, a mislabeled photo, a strange recommendation. That era is ending. The same models are now being handed cameras, grippers and wheels, and a mistake is no longer a sentence. It is a force applied to the world.
01
From predicting tokens
The shift
From predicting tokens
to predicting torques.
Now: models that see
Vision encoders became the eyes of autonomous systems: lane keeping, bin picking, inspection. Perception went straight into control loops.
Next: models that act
Vision-language-action models take pixels and an instruction and output motor commands directly. The output is the action. Nobody reviews it first.
02
A few pixels can change
The fragility we already know
A few pixels can change
what a machine believes.
In 2013, Szegedy et al. showed that image classifiers can be fooled by perturbations too small for a human to notice. A year later, Goodfellow et al. turned a confident panda into a gibbon with a single gradient step.
Then the attacks left the lab. Adversarial patches that hijack any classifier. A 3D-printed turtle classified as a rifle from almost every angle. A few stickers on a stop sign that made it read as "Speed Limit 45".
Ten years later, this problem is still not solved. Today we are putting descendants of these same vision backbones in charge of physical machines.
// perturbation_lab.py
illustrative
stop_sign97.1%
speed_limit_451.8%
yield1.1%
→ policy: BRAKE
03
VLAs merge every
When the classifier has hands
VLAs merge every
attack surface into one model.
RT-2, OpenVLA, π0: vision-language-action models build on internet-scale vision and language pretraining and finetune it into robot policies. They generalize remarkably well. They also inherit every weakness of their parents, plus new ones that only exist when outputs move metal.
CAM
Pixels
⚠ adversarial patches, physical perturbations, spoofed scenes
"..."
Language
⚠ jailbreaks, prompt injection written into the environment
VLA
Weights
⚠ backdoors, poisoned demos, misgeneralized goals
τ
Actions
⚠ unsafe trajectories, excess force, irreversible moves
Researchers have already shown that LLM-controlled robots can be jailbroken into harmful physical actions. An unsafe chatbot answer can be filtered. An unsafe trajectory has to be stopped before it happens.
ref · Robey et al., "Jailbreaking LLM-Controlled Robots", 2024// two lines, converging
2013
Intriguing properties of neural networks. Adversarial examples discovered.
2014
FGSM. One gradient step turns a panda into a gibbon.
2017
Adversarial patch. A printable sticker hijacks a classifier.
2018
Physical-world attacks. A stop sign reads as a speed limit; a turtle reads as a rifle.
2023
RT-2. Web-scale vision-language knowledge transferred to robotic control.
2024
OpenVLA · π0. Open, generalist robot policies. LLM-controlled robots jailbroken.
2025+
Humanoids leave the demo stage and move into factories, warehouses and homes.
NOW
RobSafe. Where the two lines meet.
ML safety robotics
04
The next economy
The stakes
The next economy
will have moving parts.
Software automated the work done at a desk.
Embodied AI is coming for everything else.
Picking, packing and moving goods: high-volume, repetitive and already being automated.
General-purpose arms and humanoids that can be retrained in software instead of re-engineered.
Robots working right next to people: elders, patients, children. The least forgiving setting there is.
When physical labor becomes software, robot safety stops being a niche engineering concern and becomes economic infrastructure. Insurers, regulators, operators and the people working beside these machines will all need the same answer: how do we know it's safe?
Today, nobody has a good answer. That is the gap we work in.
05
What we do
Safety, in the widest sense.
Vulnerability exploration
We red-team embodied systems end to end: physical patches, instruction injection, sensor spoofing and data poisoning, all disclosed responsibly.
Policy interpretability
We reverse-engineer what robot policies actually compute. Which internal features drive a grasp? What does the model attend to right before it fails?
Guardrails & monitors
We build runtime shields, safety envelopes, anomaly detectors and fallback controllers: the layer between a learned policy and the motors.
Benchmarks & evals
Open, reproducible tests for how embodied models behave under distribution shift, attack and ambiguous instructions.
// end of transmission
Before robots are everywhere,
let's make them safe.
Follow along as the lab notebook fills up: reproductions, experiments, write-ups and code, all in the open.