Safety-bypass susceptibility of Gemini Robotics-ER 2 is predictable by a local open-source proxy VLM without querying the target

Auto-published from arXiv:2609.38971 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.83, flags: [possible-zero-day])

Category

alignment

Model

Gemini Robotics-ER 2 (target); Qwen3-VL-30B (proxy predictor)

Surface

API (VLM planner)

Setup

For each of the 846 refused tasks, a composite signal (A5) is computed using Qwen3-VL-30B across four probes—trace ambiguity, perturbation spread, constitution reliance, and decoding instability—none of which require querying the target model. The composite is used to rank tasks by predicted malleability (likelihood of refusal bypass by object insertion) before any bypass is attempted.

Reproduction anchor

code: https://github.com/mdctleo/refusal-bend; benchmark: EARBench 846-task refused split; LatentHarm dataset (281 tasks, released with code)

Observed behavior

Qwen3-VL-30B composite achieves ROC-AUC 0.785 and identifies malleable tasks 2.4× more often than random selection. High-malleability tasks share the property that the hazard is not conspicuous in the instruction or scene—it emerges only from the instruction-scene interaction.

Expected behavior

Susceptibility to bypass should not be reliably predictable without querying the target model; an attacker should not be able to cheaply pre-screen which tasks are vulnerable.

Reproducibility

medium

Threat model

An attacker runs a local open-source VLM to pre-screen a deployed robot's task queue, identifying vulnerable tasks before interacting with the target system, then selectively rearranges the physical environment only for those tasks. Defensively, the same signal allows operators to assess per-task malleability prior to deployment and add task-specific guardrails.

Novelty

Establishes that safety-bypass susceptibility ('malleability') is an intrinsic, predictable property of task specification—not stochastic model behavior—enabling both proactive defense and systematic attacker pre-screening via a cheap open-source proxy without target model access.

Source

• arXiv: 2609.38971
• PDF: https://arxiv.org/pdf/2609.38971
• Categories: cs.CR, cs.RO
• Authors: Leo Y. Lin, Mikhail Kuznetsov, Muslum Ozgur Ozmen, Z. Berkay Celik

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 3
• triage reason: Systematic red-teaming of embodied VLM planners: demonstrates that 20.2% of safety-refused tasks can be bypassed by adding ordinary objects to the environment, with reproducible setup and predictive model identifying vulnerable tasks. No disclosed vendor coordination.

─────────────────────────────────────────────────────────────────────